DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application is being examined under the pre-AIA first to invent provisions.
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 12/07/2021, 05/03/2023, and 08/08/2025 is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Response to Arguments
101 Rejection Arguments
Applicant asserts:
Applicant argues, on page 16-18, that The amended claims recite a particular machine-learning anomaly detection system, not an abstract result untethered to technology.
Examiner response:
Examiner respectfully disagrees. Examiner notes that the use of one or more processors and training and using of the log anomaly model is interpreted as a generic computer component merely used to implement mental steps associated with classifying log lines, templatizing the classified log lines, clustering the log templates, removing the template clusters, generating an adjusted frequency threshold, identifying unlabeled log lines, identifying a subsequent log line, and identifying a cause for the log line. The step of adjusting computational resources is interpreted as insignificant extra-solution activity. The claims do no describe how the processors and model to classify log lines, templatize the classified log lines, cluster the log templates, remove the template clusters, generate an adjusted frequency threshold, identify unlabeled log lines, identify a subsequent log line, and identify a cause for the log line in a way that a person could perform these actions in their mind
Applicant asserts:
Applicant argues, on page 18-19, that The claimed steps of adjusting a frequency threshold based on the maturity level of the monitored computing system, identifying a root cause by correlating anomalies across a different computing environment, and adjusting computational resources associated with the monitored computing system constitute a specific improved way of operating a machine learning log anomaly model and its host computing system
Examiner response:
Examiner respectfully disagrees. Examiner notes MPEP 2106.04(d)(1) states that a bare assertion of an improvement is not sufficient in stating a claim is set forth to a technological improvement. the use of one or more processors and training and using of the log anomaly model is interpreted as a generic computer component merely used to implement mental steps Examiner notes that the claims and specification do not provide the detail necessary to be apparent to a person of ordinary skill in the art of the improvement.
Examiner notes that MPEP 2106.05(f) shows that merely applying the abstract idea to a generic computer component does not integrate a judicial exception into a practical application. The manner at which the computer system is used is not interpreted as an abstract idea, but a generic computer component.
103 Rejection Arguments
Applicant asserts:
Applicant argues, on page 19-20, that the prior art does not teach the limitations do not disclose at least "generating, by the one or more computer processors, an adjusted frequency threshold in response to the removing," and "adjusting the frequency threshold based on a maturity level of the monitored computing system, and wherein the adjusted frequency threshold increases exponentially as the maturity level increases,"
Examiner response:
Applicant’s arguments with respect to claim(s) 1 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument. Please see the updated 103 rejection below.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
In reference to claim 1:
Step 1 - Is the claim to a process, machine, manufacture or composition of matter?
Yes, the claim is directed to a process
Step 2A Prong 1 - Does the claim recite an abstract idea, law of nature, or natural phenomenon?
“classifying, [by one or more computer processors], each log line in a plurality of unlabeled log lines as a classified erroneous log line or a classified non-erroneous log line utilizing a dictionary based classifier within a hybrid error classifier, wherein each of the plurality of unlabeled log lines is respectively associated with streaming real-time operations of a monitored computer system, and wherein the dictionary based classifier is bootstrapped from software documentation associated with the monitored computing system, thereby identifying, from the plurality of unlabeled log lines, one or more classified erroneous log lines and one or more classified non-erroneous log lines;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could analyze the unlabeled log lines and classify them as erroneous or non-erroneous log lines using a dictionary based classifier within a hybrid error classifier/a dictionary with rule sets.
“templatizing, [by the one or more computer processors], the one or more classified erroneous log lines and the one or more non-erroneous log lines from the plurality of unlabeled log lines to generate erroneous log templates and non-erroneous log templates, wherein templatizing comprises preserving log line invariants and replacing log line parameters with a respective token;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could put the classified log lines into templates.
“clustering, by the one or more computer processors, the erroneous log templates into erroneous log template clusters and the non-erroneous log templates into non-erroneous log template clusters;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could evaluate the log templates and cluster them into the respective template clusters.
“removing, by the one or more computer processors, the erroneous log template clusters and the non-erroneous log template clusters that exceed a frequency threshold;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could remove/not consider the templates for erroneous and non-erroneous logs.
“generating, [by the one or more computer processors], an adjusted frequency threshold in response to the removing, wherein generating the adjusted frequency threshold comprises, adjusting the frequency threshold based on a maturity level of the monitored computing system, and wherein the adjusted frequency threshold increases exponentially as the maturity level increases;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could generate a frequency threshold that exponentially increases as a maturity level of the computing system increases.
“identifying, [by the one or more computer processors], one or more of the plurality of unlabeled log lines that do not exceed the adjusted frequency threshold as one or more anomalous log lines;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could identify an anomalous log line that do not exceed the adjusted frequency threshold.
“identifying, [by the one or more computer processors], a subsequent log line as a subsequent anomalous log line [utilizing the trained log anomaly model;]” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could identify if a subsequent log line is anomalous.
“identifying, [by the one or more computer processors], a cause for the subsequent anomalous log line by identifying an additional anomalous log line associated with a different computing environment that is correlated to the subsequent anomalous log line; and” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could identify a cause for the subsequent anomalous log line by identifying a correlated log line in another environment.
Step 2A Prong 2 - Does the claim recite additional elements that integrate the judicial exception into a practical application?
“by one or more computer processors” is merely reciting the words "apply it" (or an equivalent) with the judicial exception, or merely including instructions to implement an abstract idea on a computer, or merely using a computer as a tool to perform an abstract idea (MPEP 2106.05(f)).
“training, by one or more computer processors, a log anomaly model within the hybrid error classifier utilizing one or more validated log lines;” is merely reciting the words "apply it" (or an equivalent) with the judicial exception, or merely including instructions to implement an abstract idea on a computer, or merely using a computer as a tool to perform an abstract idea (MPEP 2106.05(f)).
“and responsive to identifying the cause, adjusting, by one or more computer processors, computational resources associated with the monitored computing system.” (insignificant extra-solution MPEP 2106.05(g))
The claim does not include additional elements that are integrated into a practical application.
Step 2B - Does the claim recite additional elements that amount to significantly more than the judicial exception?
“training, by one or more computer processors, a log anomaly model within the hybrid error classifier utilizing one or more validated log lines;” is merely reciting the words "apply it" (or an equivalent) with the judicial exception, or merely including instructions to implement an abstract idea on a computer, or merely using a computer as a tool to perform an abstract idea (MPEP 2106.05(f)).
“and responsive to identifying the cause, adjusting, by one or more computer processors, computational resources associated with the monitored computing system.” is merely reciting the words "apply it" (or an equivalent) with the judicial exception, or merely including instructions to implement an abstract idea on a computer, or merely using a computer as a tool to perform an abstract idea (MPEP 2106.05(f)).
“and responsive to identifying the cause, adjusting, by one or more computer processors, computational resources associated with the monitored computing system.” (insignificant extra-solution activity: see US 5351070 A Hinton Column 4 Line 67; “Various techniques are known in the prior art for identifying these errors and generating correction signals which are used to adjust the scanning system to change the beam position at the photoreceptor.” Examiner notes that in response to identifying the cause (identifying the errors), adjust computational resources associated with the monitored computing system (adjust the scanning system to change the beam position at the photoreceptor))
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception.
In reference to claim 2:
Step 1 - Is the claim to a process, machine, manufacture or composition of matter?
Yes, the claim is directed to a process
Step 2A Prong 1 - Does the claim recite an abstract idea, law of nature, or natural phenomenon?
“The computer-implemented method of claim 1, wherein identifying the subsequent log line as the subsequent anomalous log line utilizing the trained log anomaly model, further comprises: templatizing, by the one or more computer processors, the subsequent log line to generate a templatized subsequent log line;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could put the subsequent log line into a template to generate a templatized subsequent log line.
“matching, by the one or more computer processors, the templatized subsequent log line into one of the erroneous log template clusters or an one of the non-erroneous log template clusters.” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could match the templatized subsequent log line into an existing log template cluster.
Step 2A Prong 2 - Does the claim recite additional elements that integrate the judicial exception into a practical application?
No
Step 2B - Does the claim recite additional elements that amount to significantly more than the judicial exception?
No
In reference to claim 3:
Step 1 - Is the claim to a process, machine, manufacture or composition of matter?
Yes, the claim is directed to a process
Step 2A Prong 1 - Does the claim recite an abstract idea, law of nature, or natural phenomenon?
“The computer-implemented method of claim 2, further comprising: responsive to the templatized subsequent log line failing to match into any of the one or more erroneous log template clusters, classifying, by the one or more computer processors, the subsequent log line as the subsequent anomalous log line;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could observe that there is no match to the subsequent log line and classify it as anomalous.
“creating, by the one or more computer processors, a new erroneous log template cluster with the templatized subsequent log line;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could create a new erroneous log template cluster with the subsequent log line.
“setting, by the one or more computer processors, a frequency of the new erroneous log template cluster to one;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could set a frequency counter of the newly created erroneous log template cluster to one.
“and classifying, by the one or more computer processors, an occurrence of similar log lines as anomalous until the adjusted frequency threshold is reached” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could classify an occurrence of similar log lines as anomalous until a frequency threshold is reached or exceeded.
Step 2A Prong 2 - Does the claim recite additional elements that integrate the judicial exception into a practical application?
No
Step 2B - Does the claim recite additional elements that amount to significantly more than the judicial exception?
No
In reference to claim 4:
Step 1 - Is the claim to a process, machine, manufacture or composition of matter?
Yes, the claim is directed to a process
Step 2A Prong 1 - Does the claim recite an abstract idea, law of nature, or natural phenomenon?
“responsive to the templatized subsequent log line failing to match into any of the one or more non-erroneous log template clusters, classifying, by the one or more computer processors, the subsequent log line as non-anomalous log line;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could observe that there is no match to the subsequent log line and classify it as non-anomalous log line.
“creating, by the one or more computer processors, a new erroneous log template cluster with the templatized subsequent log line;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could create a new erroneous log template cluster with the subsequent log line.
“setting, by the one or more computer processors, a frequency of the new non-erroneous log template cluster to one;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could set a frequency counter of the new non-erroneous log template cluster to one.
“and classifying, by the one or more computer processors, an occurrence of similar log lines as non-anomalous until the adjusted frequency threshold and a timestamp threshold are reached” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could classify an occurrence of similar log lines as non-anomalous until a frequency threshold is reached or exceeded.
Step 2A Prong 2 - Does the claim recite additional elements that integrate the judicial exception into a practical application?
No
Step 2B - Does the claim recite additional elements that amount to significantly more than the judicial exception?
No
In reference to claim 5:
Step 1 - Is the claim to a process, machine, manufacture or composition of matter?
Yes, the claim is directed to a process
Step 2A Prong 1 - Does the claim recite an abstract idea, law of nature, or natural phenomenon?
No
Step 2A Prong 2 - Does the claim recite additional elements that integrate the judicial exception into a practical application?
“implementing, by one or more computer processors, a remedy to the identified anomalous subsequent log line.” (insignificant extra-solution activity mere data gathering MPEP 2106.05(g))
Step 2B - Does the claim recite additional elements that amount to significantly more than the judicial exception?
“implementing, by one or more computer processors, a remedy to the identified anomalous subsequent log line.” (insignificant extra-solution activity: see US 20210133369 A1 Cader Paragraph 0080; “one or more corrective actions can be performed to remedy or attempt to remedy the identified anomaly and/or causes of the anomaly. It should be understood that many corrective measures known to those of skill in the art can be triggered, based on the information identified in the diagnosis of step 1156.” Examiner notes that a remedy to the identified anomalous subsequent log line (one or more corrective actions can be performed to remedy or attempt to remedy the identified anomaly and/or causes of the anomaly) is implemented/triggered)
In reference to claim 6:
Claim 6 is directed to a judicial exception from claim(s) depended on and does not recite additional elements that integrate the judicial exception into a practical application and amount to significantly more than the judicial exception.
In reference to claim 7:
Claim 7 is directed to a judicial exception from claim(s) depended on and does not recite additional elements that integrate the judicial exception into a practical application and amount to significantly more than the judicial exception.
In reference to claim 8:
Step 1 - Is the claim to a process, machine, manufacture or composition of matter?
Yes, the claim is directed to a machine
Step 2A Prong 1 - Does the claim recite an abstract idea, law of nature, or natural phenomenon?
“classify each log line in a plurality of unlabeled log lines as a classified erroneous log line or a classified non-erroneous log line utilizing a dictionary based classifier within a hybrid error classifier, wherein each of the plurality of unlabeled log lines is respectively associated with streaming real-time operations of a monitored computer system, and wherein the dictionary based classifier is bootstrapped from software documentation associated with the monitored computing system, thereby identifying, from the plurality of unlabeled log lines, one or more classified erroneous log lines and one or more classified non-erroneous log lines;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could analyze the unlabeled log lines and classify them as erroneous or non-erroneous log lines using a dictionary based classifier within a hybrid error classifier/a dictionary with rule sets.
“templatize the one or more classified erroneous log lines and the one or more non-erroneous log lines from the plurality of unlabeled log lines to generate erroneous log templates and non-erroneous log templates, wherein templatizing comprises preserving log line invariants and replacing log line parameters with a respective token;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could put the classified log lines into templates.
“cluster the erroneous log templates into erroneous log template clusters and the non-erroneous log templates into non-erroneous log template clusters;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could evaluate the log templates and cluster them into the respective template clusters.
“remove the erroneous log template clusters and the non- erroneous log template clusters that exceed a frequency threshold;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could remove/not consider the templates for erroneous and non-erroneous logs.
“generate an adjusted frequency threshold in response to the removing, wherein generating the adjusted frequency threshold comprises, adjusting the frequency threshold based on a maturity level of the monitored computing system, and wherein the adjusted frequency threshold increases exponentially as the maturity level increases;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could adjust a frequency threshold utilizing an exponentially increasing function based on a maturity of the computing system.
“identify one or more of the plurality of unlabeled log lines that do not exceed the adjusted frequency threshold as one or more anomalous log lines;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could identify an anomalous log line that do not exceed the adjusted frequency threshold.
“identify a subsequent log line as a subsequent anomalous log line utilizing the trained log anomaly model;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could identify if a subsequent log line is anomalous.
“identify a cause for the subsequent anomalous log line by identifying an additional anomalous log line associated with a different computing environment that is correlated to the subsequent anomalous log line; and” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could identify a cause for the subsequent anomalous log line by identifying a correlated log line in another environment.
Step 2A Prong 2 - Does the claim recite additional elements that integrate the judicial exception into a practical application?
“A computer program product comprising: one or more computer readable storage media and program instructions stored on the one or more computer readable storage media, wherein the stored program instructions, when executed by one or more computer processors, cause the one or more computer processors to:” is merely reciting the words "apply it" (or an equivalent) with the judicial exception, or merely including instructions to implement an abstract idea on a computer, or merely using a computer as a tool to perform an abstract idea (MPEP 2106.05(f)).
“train a log anomaly model within the hybrid error classifier utilizing the one or more anomalous log lines, thereby generating a trained log anomaly model;” is merely reciting the words "apply it" (or an equivalent) with the judicial exception, or merely including instructions to implement an abstract idea on a computer, or merely using a computer as a tool to perform an abstract idea (MPEP 2106.05(f)).
“adjust, responsive to identifying the cause, computational resources associated with the monitored computing system.” (insignificant extra-solution MPEP 2106.05(g))
The claim does not include additional elements that are integrated into a practical application.
Step 2B - Does the claim recite additional elements that amount to significantly more than the judicial exception?
“A computer program product comprising: one or more computer readable storage media and program instructions stored on the one or more computer readable storage media, wherein the stored program instructions, when executed by one or more computer processors, cause the one or more computer processors to:” is merely reciting the words "apply it" (or an equivalent) with the judicial exception, or merely including instructions to implement an abstract idea on a computer, or merely using a computer as a tool to perform an abstract idea (MPEP 2106.05(f)).
“train a log anomaly model within the hybrid error classifier utilizing the one or more anomalous log lines, thereby generating a trained log anomaly model;” is merely reciting the words "apply it" (or an equivalent) with the judicial exception, or merely including instructions to implement an abstract idea on a computer, or merely using a computer as a tool to perform an abstract idea (MPEP 2106.05(f)).
“adjust, responsive to identifying the cause, computational resources associated with the monitored computing system.” (insignificant extra-solution activity: see US 5351070 A Hinton Column 4 Line 67; “Various techniques are known in the prior art for identifying these errors and generating correction signals which are used to adjust the scanning system to change the beam position at the photoreceptor.” Examiner notes that in response to identifying the cause (identifying the errors), adjust computational resources associated with the monitored computing system (adjust the scanning system to change the beam position at the photoreceptor))
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception.
In reference to claim 9:
Step 1 - Is the claim to a process, machine, manufacture or composition of matter?
Yes, the claim is directed to a machine
Step 2A Prong 1 - Does the claim recite an abstract idea, law of nature, or natural phenomenon?
“The computer program product of claim 8, wherein identifying the subsequent log line as the subsequent anomalous log line utilizing the trained log anomaly model comprises causing the one or more computer processors to: templatize the subsequent log line to generate a templatized subsequent log line; and” which is an abstract idea because it is directed to a mental u process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could put the subsequent log line into a template.
“match the templatized subsequent log line into one of the an erroneous log template clusters or one of the non-erroneous log template clusters.” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could match the templatized subsequent log line into an existing log template cluster.
Step 2A Prong 2 - Does the claim recite additional elements that integrate the judicial exception into a practical application?
No
Step 2B - Does the claim recite additional elements that amount to significantly more than the judicial exception?
No
In reference to claim 10:
Step 1 - Is the claim to a process, machine, manufacture or composition of matter?
Yes, the claim is directed to a machine
Step 2A Prong 1 - Does the claim recite an abstract idea, law of nature, or natural phenomenon?
“responsive to the templatized subsequent log line failing to match into any of the erroneous log template clusters, classify the subsequent log line as the subsequent anomalous log line;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could observe that there is no match to the subsequent log line and classify it as anomalous.
“create a new erroneous log template cluster with the templatized subsequent log line;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could create a new erroneous log template cluster with the subsequent log line.
“set a frequency of the new erroneous log template cluster to one; and” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could set a frequency counter of the newly created erroneous log template cluster to one.
“classify an occurrence of similar log lines as anomalous until the adjusted frequency threshold is reached.” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could classify an occurrence of similar log lines as anomalous until a frequency threshold is reached or exceeded.
Step 2A Prong 2 - Does the claim recite additional elements that integrate the judicial exception into a practical application?
No
Step 2B - Does the claim recite additional elements that amount to significantly more than the judicial exception?
No
In reference to claim 11:
Step 1 - Is the claim to a process, machine, manufacture or composition of matter?
Yes, the claim is directed to a machine
Step 2A Prong 1 - Does the claim recite an abstract idea, law of nature, or natural phenomenon?
“responsive to the templatized subsequent log line failing to match into any of the non-erroneous log template clusters, classify the subsequent log line as anon-anomalous log line;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could observe that there is no match to the subsequent log line and classify it as non-anomalous.
“create a new non-erroneous log template cluster with the templatized subsequent log line;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could create a new erroneous log template cluster with the subsequent log line.
“set a frequency of the new non-erroneous log template cluster to one; and” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could set a frequency counter of the newly created erroneous log template cluster to one.
“classify an occurrence of similar log lines as non-anomalous until the adjusted frequency threshold and a timestamp threshold are reached.” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could classify an occurrence of similar log lines as non-anomalous until a frequency threshold is reached or exceeded.
Step 2A Prong 2 - Does the claim recite additional elements that integrate the judicial exception into a practical application?
No
Step 2B - Does the claim recite additional elements that amount to significantly more than the judicial exception?
No
In reference to claim 12:
Step 1 - Is the claim to a process, machine, manufacture or composition of matter?
Yes, the claim is directed to a machine
Step 2A Prong 1 - Does the claim recite an abstract idea, law of nature, or natural phenomenon?
No
Step 2A Prong 2 - Does the claim recite additional elements that integrate the judicial exception into a practical application?
“implement a remedy to the subsequent anomalous log line.” (insignificant extra-solution activity mere data gathering MPEP 2106.05(g))
Step 2B - Does the claim recite additional elements that amount to significantly more than the judicial exception?
“implement a remedy to the subsequent anomalous log line” (insignificant extra-solution activity: see US 20210133369 A1 Cader Paragraph 0080; “one or more corrective actions can be performed to remedy or attempt to remedy the identified anomaly and/or causes of the anomaly. It should be understood that many corrective measures known to those of skill in the art can be triggered, based on the information identified in the diagnosis of step 1156.” Examiner notes that a remedy to the identified anomalous subsequent log line (one or more corrective actions can be performed to remedy or attempt to remedy the identified anomaly and/or causes of the anomaly) is implemented/triggered)
In reference to claim 13:
Claim 13 is directed to a judicial exception from claim(s) depended on and does not recite additional elements that integrate the judicial exception into a practical application and amount to significantly more than the judicial exception.
In reference to claim 14:
Claim 14 is directed to a judicial exception from claim(s) depended on and does not recite additional elements that integrate the judicial exception into a practical application and amount to significantly more than the judicial exception.
In reference to claim 15:
Step 1 - Is the claim to a process, machine, manufacture or composition of matter?
Yes, the claim is directed to a manufacture
Step 2A Prong 1 - Does the claim recite an abstract idea, law of nature, or natural phenomenon?
“classify each log line in a plurality of unlabeled log lines as a classified erroneous log line or a classified non-erroneous log line utilizing a dictionary based classifier within a hybrid error classifier, wherein each of the plurality of unlabeled log lines is respectively associated with streaming real-time operations of a monitored computer system, and wherein the dictionary based classifier is bootstrapped from software documentation associated with the monitored computing system, thereby identifying, from the plurality of unlabeled log lines, one or more classified erroneous log lines and one or more classified non-erroneous log lines;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could analyze the unlabeled log lines and classify them as erroneous or non-erroneous log lines using a dictionary based classifier within a hybrid error classifier/a dictionary with rule sets.
“templatize the one or more classified erroneous log lines and the one or more non-erroneous log lines from the plurality of unlabeled log lines to generate erroneous log templates and non-erroneous log templates, wherein templatizing comprises preserving log line invariants and replacing log line parameters with a respective token;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could put the classified log lines into templates.
“cluster the erroneous log templates into erroneous log template clusters and the non-erroneous log templates into non-erroneous log template clusters;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could evaluate the log templates and cluster them into the respective template clusters.
“remove the erroneous log template clusters and the non- erroneous log template clusters that exceed a frequency threshold;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could remove/not consider the templates for erroneous and non-erroneous logs.
“generate an adjusted frequency threshold in response to the removing, wherein generating the adjusted frequency threshold comprises, adjusting the frequency threshold based on a maturity level of the monitored computing system, and wherein the adjusted frequency threshold increases exponentially as the maturity level increases;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could adjust a frequency threshold utilizing an exponentially increasing function based on a maturity of the computing system.
“identify one or more of the plurality of unlabeled log lines that do not exceed the adjusted frequency threshold as one or more anomalous log lines;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could identify an anomalous log line that do not exceed the adjusted frequency threshold.
“identify a subsequent log line as a subsequent anomalous log line utilizing the trained log anomaly model;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could identify if a subsequent log line is anomalous.
“identify a cause for the subsequent anomalous log line by identifying an additional anomalous log line associated with a different computing environment that is correlated to the subsequent anomalous log line; and” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could identify a cause for the subsequent anomalous log line by identifying a correlated log line in another environment.
Step 2A Prong 2 - Does the claim recite additional elements that integrate the judicial exception into a practical application?
“A computer system comprising: one or more computer processors; one or more computer readable storage media; and program instructions stored on the one or more computer readable storage media wherein the stored program instructions, when executed by the one or more computer processors, cause the one or more computer processors to:” is merely reciting the words "apply it" (or an equivalent) with the judicial exception, or merely including instructions to implement an abstract idea on a computer, or merely using a computer as a tool to perform an abstract idea (MPEP 2106.05(f)).
“train a log anomaly model within the hybrid error classifier utilizing the one or more anomalous log lines, thereby generating a trained log anomaly model;” is merely reciting the words "apply it" (or an equivalent) with the judicial exception, or merely including instructions to implement an abstract idea on a computer, or merely using a computer as a tool to perform an abstract idea (MPEP 2106.05(f)).
“adjust, responsive to identifying the cause, computational resources associated with the monitored computing system.” (insignificant extra-solution MPEP 2106.05(g))
The claim does not include additional elements that are integrated into a practical application.
Step 2B - Does the claim recite additional elements that amount to significantly more than the judicial exception?
“A computer program product comprising: one or more computer readable storage media and program instructions stored on the one or more computer readable storage media, wherein the stored program instructions, when executed by one or more computer processors, cause the one or more computer processors to:” is merely reciting the words "apply it" (or an equivalent) with the judicial exception, or merely including instructions to implement an abstract idea on a computer, or merely using a computer as a tool to perform an abstract idea (MPEP 2106.05(f)).
“train a log anomaly model within the hybrid error classifier utilizing the one or more anomalous log lines, thereby generating a trained log anomaly model;” is merely reciting the words "apply it" (or an equivalent) with the judicial exception, or merely including instructions to implement an abstract idea on a computer, or merely using a computer as a tool to perform an abstract idea (MPEP 2106.05(f)).
“adjust, responsive to identifying the cause, computational resources associated with the monitored computing system.” (insignificant extra-solution activity: see US 5351070 A Hinton Column 4 Line 67; “Various techniques are known in the prior art for identifying these errors and generating correction signals which are used to adjust the scanning system to change the beam position at the photoreceptor.” Examiner notes that in response to identifying the cause (identifying the errors), adjust computational resources associated with the monitored computing system (adjust the scanning system to change the beam position at the photoreceptor))
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception.
In reference to claim 16:
Step 1 - Is the claim to a process, machine, manufacture or composition of matter?
Yes, the claim is directed to a manufacture
Step 2A Prong 1 - Does the claim recite an abstract idea, law of nature, or natural phenomenon?
“templatize the subsequent log line to generate a templatized subsequent log line; and” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could put the subsequent log line into a template.
“match the templatized subsequent log line into one of the an erroneous log template clusters or one of the non-erroneous log template clusters.” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could match the templatized subsequent log line into an existing log template cluster.
Step 2A Prong 2 - Does the claim recite additional elements that integrate the judicial exception into a practical application?
No
Step 2B - Does the claim recite additional elements that amount to significantly more than the judicial exception?
No
In reference to claim 17:
Step 1 - Is the claim to a process, machine, manufacture or composition of matter?
Yes, the claim is directed to a manufacture
Step 2A Prong 1 - Does the claim recite an abstract idea, law of nature, or natural phenomenon?
“responsive to the templatized subsequent log line failing to match into any of the erroneous log template clusters, classify the subsequent log line as the subsequent anomalous log line;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could observe that there is no match to the subsequent log line and classify it as anomalous.
“create a new erroneous log template cluster with the templatized subsequent log line;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could create a new erroneous log template cluster with the subsequent log line.
“set a frequency of the new erroneous log template cluster to one; and” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could set a frequency counter of the newly created erroneous log template cluster to one.
“and program instructions to classify an occurrence of similar log lines as anomalous until a frequency threshold is reached. classify an occurrence of similar log lines as anomalous until the adjusted frequency threshold is reached.” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could classify an occurrence of similar log lines as anomalous until a frequency threshold is reached or exceeded.
Step 2A Prong 2 - Does the claim recite additional elements that integrate the judicial exception into a practical application?
No
Step 2B - Does the claim recite additional elements that amount to significantly more than the judicial exception?
No
In reference to claim 18:
Step 1 - Is the claim to a process, machine, manufacture or composition of matter?
Yes, the claim is directed to a manufacture
Step 2A Prong 1 - Does the claim recite an abstract idea, law of nature, or natural phenomenon?
“responsive to the templatized subsequent log line failing to match into any of the non-erroneous log template clusters, classify the subsequent log line as anon-anomalous log line;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could observe that there is no match to the subsequent log line and classify it as non-anomalous.
“create a new non-erroneous log template cluster with the templatized subsequent log line;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could create a new erroneous log template cluster with the subsequent log line.
“set a frequency of the new non-erroneous log template cluster to one;” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could set a frequency counter of the newly created erroneous log template cluster to one.
“classify an occurrence of similar log lines as non-anomalous until the adjusted frequency threshold and a timestamp threshold are reached.” which is an abstract idea because it is directed to a mental process, an observation, evaluation, judgement, or opinion. The limitation as drafted, and under a broadest reasonable interpretation, can be performed in the human mind, or by a human using a pen and paper (MPEP 2106.04(a)(2)(Ill)(c)). For example, a person could classify an occurrence of similar log lines as non-anomalous until a frequency threshold is reached or exceeded.
Step 2A Prong 2 - Does the claim recite additional elements that integrate the judicial exception into a practical application?
No
Step 2B - Does the claim recite additional elements that amount to significantly more than the judicial exception?
No
In reference to claim 19:
Step 1 - Is the claim to a process, machine, manufacture or composition of matter?
Yes, the claim is directed to a manufacture
Step 2A Prong 1 - Does the claim recite an abstract idea, law of nature, or natural phenomenon?
No
Step 2A Prong 2 - Does the claim recite additional elements that integrate the judicial exception into a practical application?
“implement a remedy to the subsequent anomalous log line.” (insignificant extra-solution activity mere data gathering MPEP 2106.05(g))
Step 2B - Does the claim recite additional elements that amount to significantly more than the judicial exception?
“implement a remedy to the subsequent anomalous log line” (insignificant extra-solution activity: see US 20210133369 A1 Cader Paragraph 0080; “one or more corrective actions can be performed to remedy or attempt to remedy the identified anomaly and/or causes of the anomaly. It should be understood that many corrective measures known to those of skill in the art can be triggered, based on the information identified in the diagnosis of step 1156.” Examiner notes that a remedy to the identified anomalous subsequent log line (one or more corrective actions can be performed to remedy or attempt to remedy the identified anomaly and/or causes of the anomaly) is implemented/triggered)
In reference to claim 20:
Claim 20 is directed to a judicial exception from claim(s) depended on and does not recite additional elements that integrate the judicial exception into a practical application and amount to significantly more than the judicial exception.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1-6, 8-13, and 15-20 are rejected under 35 U.S.C. 103 as being unpatentable over TORA; Shotaro et al; US 20220123988 A1 (hereinafter “Tora”) in view of CHANG PENG et al; WO 2006026688 A2 (hereinafter “Chang”) in further view of Rosie et al; “Bootstrapping for Text Learning Tasks” (hereinafter “Rosie”) in further view of Prasenjeet et al; US 20220103418 A1 (hereinafter “Prasenjeet”) in further view of Frank Yu et al; US 20120278543 A1 (hereinafter “Yu”) in further view of Mark Stuart Day; US 7814542 B1 (hereinafter “Day”) in further view of XPLG.com; “What Is Log Correlation? Making Sense of Disparate Logs” (hereinafter “XPLG”)
Regarding claim 1, Tora teaches A computer-implemented method comprising: classifying, by one or more computer processors, each log line in a plurality of unlabeled log lines as a classified erroneous log line or a classified non-erroneous log line utilizing a dictionary based classifier [within a hybrid error classifier]; (Tora Paragraph 0034; " the classification unit 15a refers to dictionary information stored in the storage unit 14, classifies the messages included in the text log by type, and assigns an ID to each of the classified messages." Tora Paragraph 0048; “the detection unit 15b detects an anomaly based on the ID assigned to the message by the classification unit 15a.” Examiner notes that the message is the log line and is classified using a dictionary based classifier as an ID; The ID is used to determine if the message is a classified erroneous or non-erroneous log line (anomaly));
wherein each of the plurality of unlabeled log lines log line is respectively associated with streaming real-time operations of a monitored computing system; (Tora Paragraph 0030; "The text log is, for example, an OS syslog, an application and database execution log, an error log, an operating log, MIB information obtained from a network device, a monitoring system alert, a behavior log, an operating state log, or the like." Tora Paragraph 0031; "As illustrated in FIG. 2, each record of the text log includes a message and an occurrence date and time attached to the message. For example, a record on the first line of the text log includes the message “LINK-UP Interface 1/0/17” and the occurrence date and time “2015/05/18 T14:56”." Examiner notes that each log line (text log) is respectively associated with streaming real-time operations of a monitored computing system)
thereby identifying, from the plurality of unlabeled log lines, one or more classified erroneous log lines and one or more classified non-erroneous log lines (Tora Paragraph 0034; " the classification unit 15a refers to dictionary information stored in the storage unit 14, classifies the messages included in the text log by type, and assigns an ID to each of the classified messages." Tora Paragraph 0048; “the detection unit 15b detects an anomaly based on the ID assigned to the message by the classification unit 15a.” Examiner notes that the message is the log line and is classified using a dictionary based classifier as an ID; The ID is used to determine if the message is a classified erroneous or non-erroneous log line (anomaly))
templatizing, by the one or more computer processors, the one or more classified erroneous log line and the one or more non-erroneous log line in the plurality of unlabeled log lines to generate erroneous log templates and non-erroneous log templates; (Tora Paragraph 0036; "the classification unit 15a compares each word sequence of a group of templates in the dictionary information stored in the storage unit 14 with each of the classified words, and when there is a template for which the word sequence matches all the words in a portion classified as non-parameter in the message, the classification unit 15a assigns the ID of the template to the message." Tora Paragraph 0044; “when a template having the word sequence that matches the message is not present in the dictionary information 14b, the classification unit 15a assigns a new ID that has not yet been assigned, and adds a new template to the dictionary information 14b based on the message.” Tora Paragraph 0064; “if the number of new templates per unit time exceeds the predetermined number (Yes in step S107), the detection unit 15b detects an anomaly (step S108).” Examiner notes that assigning the ID or creating new ID of the template to the message is templatizing to generate erroneous and non-erroneous log templates; classified erroneous log lines have a template with new ID detected as an anomaly and non-erroneous log lines have a template with ID not detected as an anomaly; Each word sequence is each classified erroneous log line and non-erroneous log line in the plurality of unlabeled log lines);
wherein templatizing comprises preserving log line invariants and replacing log line parameters with a respective token; (Tora Paragraph 0036; "Further, the classification unit 15a compares each word sequence of a group of templates in the dictionary information stored in the storage unit 14 with each of the classified words, and when there is a template for which the word sequence matches all the words in a portion classified as non-parameter in the message, the classification unit 15a assigns the ID of the template to the message." Tora Paragraph 0038; "At this time, the classification unit 15a may add a wild card such as “*” to the portion where the parameter has been deleted." Examiner notes that log line invariants (non-parameter words) is preserved in the template (word sequence) and log line parameters (parameter) is replaced with a respective token ("*"))
clustering, by the one or more computer processors, the erroneous log templates into erroneous log template clusters and the non-erroneous log templates into non-erroneous log template clusters; (Tora Paragraph 0036; "the classification unit 15a compares each word sequence of a group of templates in the dictionary information stored in the storage unit 14 with each of the classified words, and when there is a template for which the word sequence matches all the words in a portion classified as non-parameter in the message, the classification unit 15a assigns the ID of the template to the message." Examiner notes that the erroneous and non-erroneous log templates are clustered into appropriate template clusters based on the template IDs);
identifying, by the one or more computer processors, a subsequent log line as a subsequent anomalous log line utilizing the trained log anomaly model. (Tora Paragraph 0052; "As illustrated in FIG. 9, for a new log output from a system in which an anomaly has occurred, the anomaly detection apparatus 10 refers to the dictionary information 14b stored in the storage unit 14, and assigns a new ID to the message of the text log that is not registered in the dictionary information." Tora Paragraph 0062; “when the classification unit 15a of the anomaly detection apparatus 10 receives a log message (Yes in step S101),” Tora Paragraph 0064; “if the number of new templates per unit time exceeds the predetermined number (Yes in step S107), the detection unit 15b detects an anomaly (step S108).” Examiner notes that new log output from a system is subsequent log line; the anomaly detection apparatus is the trained log anomaly model that identifies a subsequent log line as a subsequent anomalous log line (detection unit 15b detects an anomaly))
PNG
media_image1.png
774
432
media_image1.png
Greyscale
And responsive to identifying the cause, adjusting, by the one or more computer processors, computational resources associated with the monitored computing system. (Tora Paragraph 0053; "an unknown anomaly can be found early by monitoring the number of new IDs assigned per unit time, and it is possible to perform troubleshooting before the user report." Examiner notes that responsive to identifying, the computational resources associated with the monitored computing system is adjusted (perform troubleshooting))
Tora does not teach within a hybrid error classifier. However, Chang does teach within a hybrid error classifier (Chang Paragraph 0029; "Several sub-classifiers may be used as input to a hybrid classifier." Examiner notes that a dictionary based classifier within a hybrid error classifier is one of the several sub classifiers in the hybrid classifier)
It would have obvious to one of ordinary skill in the art before the effective filing date of the present application to combine Tora and Chang. Tora teaches an anomaly detection apparatus that uses dictionary based classifier to classify the text logs. Chang teaches the benefits of using a plurality of sub-classifiers in a hybrid classifier to classify an object in an image. One of ordinary skill would have motivation to combine Tora and Chang to include a hybrid classifier that includes dictionary based classifier for the robustness in performance “FIG. 11 shows the error rate of the hybrid classifiers on the testing set. The performance on the testing set has thus been found to be comparable to the performance on the training set, indicative of the robustness of this approach.” (Chang Paragraph 0041).
Tora in view of Chang does not teach and wherein the dictionary based classifier is bootstrapped from software documentation associated with the monitored computing system, [thereby identifying, from the plurality of unlabeled log lines, one or more classified erroneous log lines and one or more classified non-erroneous log lines]
However, Rosie does teach and wherein the dictionary based classifier is bootstrapped from software documentation associated with the monitored computing system, [thereby identifying, from the plurality of unlabeled log lines, one or more classified erroneous log lines and one or more classified non-erroneous log lines]; (Rosie Table 2 shows a bootstrapping algorithm to output a naïve Bayes classifier; Rosie Section 3 Paragraph 3; “Using bootstrapping techniques described in section 2, we have developed an algorithm that can learn dictionaries for information extraction without any special training resources.” Rosie Section 4.3 Paragraph 1; “As a test domain, we use computer science research papers.” Examiner notes that the bootstrapping uses computer science research papers which include software documentation associated with the monitored computing system as shown in Figure 5; bootstrapping techniques learn dictionaries making the classifier dictionary based)
PNG
media_image2.png
434
387
media_image2.png
Greyscale
PNG
media_image3.png
333
790
media_image3.png
Greyscale
It would have obvious to one of ordinary skill in the art before the effective filing date of the present application to combine Tora, Chang, and Rosie. Tora teaches an anomaly detection apparatus that uses dictionary based classifier to classify the text logs. Chang teaches the benefits of using a plurality of sub-classifiers in a hybrid classifier to classify an object in an image. Rosie teaches bootstrapping for text learning tasks. One of ordinary skill would have motivation to combine Tora, Chang, and Rosie to utilize bootstrapping techniques to gain semantic lexicon and extraction patterns without special training resources “Our bootstrapping approach has two advantages over previous techniques for learning information extraction dictionaries: both a semantic lexicon and a dictionary of extraction patterns are acquired simultaneously, and no special training resources are needed” (Rosie 1 Paragraph prior to Section 4).
Tora in view of Chang in further view of Rosie does not teach removing, by the one or more computer processors, the erroneous log template clusters and the non-erroneous log template clusters that exceed a frequency threshold;
Generating, by the one or more computer processors, and adjusted frequency threshold in response to the removing, wherein generating the adjusted frequency threshold comprises, adjusting the frequency threshold based on a maturity level of the monitored computing system, and wherein the adjusted frequency threshold increases exponentially as the maturity level increases;
identifying, by the one or more computer processors, one or more of the plurality of unlabeled log lines that do not exceed the adjusted frequency threshold as one or more anomalous log lines
training, by one or more computer processors, a log anomaly model within the hybrid error classifier utilizing one or more anomalous log lines, thereby generating a trained log anomaly model;
However, Prasenjeet does teach removing, by the one or more computer processors, the erroneous log template clusters and the non-erroneous log template clusters that exceed a frequency threshold; (Prasenjeet Paragraph 0039; "the plurality of log templates included in the dictionary is updated during operation of the machine learning model to remove log templates no longer observed in actual log templates from the system by removing operational logs that were added during a particular time range (e.g., to roll back a system change, in response to detecting a security threat that was active during the time range) or that have not been observed in a given length of time (e.g., as network conditions change)." Examiner notes that erroneous and non-erroneous log template clusters are removed when a frequency threshold is exceeded (has not been observed in a given length of time))
Generating, by the one or more computer processors, an [adjusted] frequency threshold in response to the removing, [wherein generating the adjusted frequency threshold comprises, adjusting the frequency threshold based on a maturity level of the monitored computing system, and wherein the adjusted frequency threshold increases exponentially as the maturity level increases;] (Prasenjeet Paragraph 0039; “The operator maintains the machine learning model and dictionary of log templates based on changing network conditions to better recognize new templates that were once anomalous, but are now commonplace, or that where once commonplace, but are now anomalous… In another example, the plurality of log templates included in the dictionary is updated during operation of the machine learning model to remove log templates no longer observed in actual log templates from the system by removing operational logs that were added during a particular time range (e.g., to roll back a system change, in response to detecting a security threat that was active during the time range) or that have not been observed in a given length of time (e.g., as network conditions change).” Examiner notes that a frequency threshold (given length of time maintained my operator) is generated/maintained in response to the removing)
identifying, by the one or more computer processors, one or more of the plurality of unlabeled log lines that do not exceed the [adjusted] frequency threshold as one or more anomalous log lines (Prasenjeet Paragraph 0039; "The operator maintains the machine learning model and dictionary of log templates based on changing network conditions to better recognize new templates that were once anomalous, but are now commonplace, or that where once commonplace, but are now anomalous… the plurality of log templates included in the dictionary is updated during operation of the machine learning model to remove log templates no longer observed in actual log templates from the system by removing operational logs that were added during a particular time range (e.g., to roll back a system change, in response to detecting a security threat that was active during the time range) or that have not been observed in a given length of time (e.g., as network conditions change)." Examiner notes that if the unlabeled log lines (logs seen as commonplace) did not exceed the frequency threshold (was observed within particular time range) then they are identified as anomalous (still identified as anomalous and not commonplace))
training, by one or more computer processors, a log anomaly model within the hybrid error classifier utilizing one or more anomalous log lines, thereby generating a trained log anomaly model; (Prasenjeet Paragraph 0024; “The anomaly detection model 240 is fitted based on the training logs 210a to identify patterns in the network behavior as indicated in the logs 210. The anomaly detection model 240 determines whether a given log entry is anomalous as a seq2seq (sequence to sequence) prediction problem.” Examiner notes that log anomaly model (anomaly detection model) is trained utilizing one or more anomalous log lines (training logs))
It would have obvious to one of ordinary skill in the art before the effective filing date of the present application to combine Tora, Chang, Rosie, and Prasenjeet. Tora teaches an anomaly detection apparatus that uses dictionary based classifier to classify the text logs. Chang teaches the benefits of using a plurality of sub-classifiers in a hybrid classifier to classify an object in an image. Rosie teaches bootstrapping for text learning tasks. Prasenjeet teaches anomaly detection and filtering based on system logs. One of ordinary skill would have motivation to combine Tora, Chang, Rosie, and Prasenjeet to remove log templates when not used for a period of time to improve efficiency and accuracy of reports “Accordingly, the present disclosure provides for improvements in the efficiency and accuracy of reporting network anomalies, and reduces the incidence of false positive or extraneous anomaly reports, among other benefits.” (Prasenjeet Paragraph 0014).
Tora in view of Chang in further view of Rosie in further view of Prasenjeet does not teach wherein generating the adjusted [frequency] threshold comprises, adjusting the [frequency] threshold based on a maturity level of the monitored computing system, and wherein the adjusted [frequency] threshold increases [exponentially] as the maturity level increases;
However, Yu does teach wherein generating the adjusted [frequency] threshold comprises, adjusting the [frequency] threshold based on a maturity level of the monitored computing system, and wherein the adjusted [frequency] threshold increases [exponentially] as the maturity level increases; (Yu Paragraph 0084; “The WLC threshold is increased over time, such as each time that a WLC swap occurs. The WLC threshold is initially much smaller than the BBN threshold, but as the system ages, the WLC threshold becomes larger.” Examiner notes that the threshold is adjusted based on a maturity level of the monitored computing system (as the system ages), and wherein the adjusted threshold increases as the maturity level increases (as the system ages, the WLC threshold becomes larger; as seen in Fig 8))
PNG
media_image4.png
240
496
media_image4.png
Greyscale
It would have obvious to one of ordinary skill in the art before the effective filing date of the present application to combine Tora, Chang, Rosie, Prasenjeet, and Yu. Tora teaches an anomaly detection apparatus that uses dictionary based classifier to classify the text logs. Chang teaches the benefits of using a plurality of sub-classifiers in a hybrid classifier to classify an object in an image. Rosie teaches bootstrapping for text learning tasks. Prasenjeet teaches anomaly detection and filtering based on system logs. Yu teaches increasing threshold as system ages. One of ordinary skill would have motivation to combine Tora, Chang, Rosie, Prasenjeet, and Yu to improve the fault tolerance of a system “The overall system fault tolerance is significantly improved.” (Yu Paragraph 0130).
Tora in view of Chang in further view of Rosie in further view of Prasenjeet in further view of Yu does not teach threshold increases exponentially
However, Day does teach threshold increases exponentially (Day Claim 12; “wherein the recurrence threshold is increased according to a binary exponential backoff algorithm;” Examiner notes that threshold increases exponentially (threshold is increased according to a binary exponential backoff algorithm))
It would have obvious to one of ordinary skill in the art before the effective filing date of the present application to combine Tora, Chang, Rosie, Prasenjeet, Yu, and Day. Tora teaches an anomaly detection apparatus that uses dictionary based classifier to classify the text logs. Chang teaches the benefits of using a plurality of sub-classifiers in a hybrid classifier to classify an object in an image. Rosie teaches bootstrapping for text learning tasks. Prasenjeet teaches anomaly detection and filtering based on system logs. Yu teaches increasing threshold as system ages. Day teaches increasing threshold based on a binary exponential backoff. One of ordinary skill would have motivation to combine Tora, Chang, Rosie, Prasenjeet, Yu, and Day to adjust the threshold to a match it to a level consistent with normal usage, and mitigate harmful effects “Such restricting, or throttling, does not absolutely prevent the user from connecting, but reduces it to a level consistent with normal usage, thus mitigating any harmful effects due to rapid connection attempts.” (Day Column 3 Line 47).
Tora in view of Chang in further view of Rosie in further view of Prasenjeet in further view of Yu in further view of Day does not teach identifying, by the one or more computer processors, a cause for the subsequent anomalous log line by identifying an additional anomalous log line associated with a different computing environment that is correlated to the subsequent anomalous log line;
However, XPLG does teach identifying, by one or more computer processors, a cause for the subsequent anomalous log line by identifying an anomalous log line associated with another environment that is correlated to the subsequent anomalous log line; (XPLG Section "Tying the Threads Together" Paragraph 1; "It’s able to track actions throughout your system and trace the logs they generate. That’s the “correlate” part of log correlation. Under the hood, log correlation is a terrific bit of engineering. Application programmers build pattern-matching software which is able to direct the software to determine which parts of disparate logs represent the same action." XPLG Section "Working Automatically With Different Systems" Paragraph 1; "You’re able to quickly and smoothly determine how a bug traced through your system, and root out the cause in minutes. What’s more, slight configuration differences in systems can cause big problems in log collection." Examiner notes that identifying a cause for the subsequent anomalous log line by identifying an anomalous log line (track actions/logs to root cause) associated with a different computing environment (older version of system) that is correlated to the subsequent anomalous log line (track actions throughout your system and trace the logs they generate))
It would have obvious to one of ordinary skill in the art before the effective filing date of the present application to combine Tora, Chang, Rosie, Prasenjeet, Yu, Day, and XPLG. Tora teaches an anomaly detection apparatus that uses dictionary based classifier to classify the text logs. Chang teaches the benefits of using a plurality of sub-classifiers in a hybrid classifier to classify an object in an image. Rosie teaches bootstrapping for text learning tasks. Prasenjeet teaches anomaly detection and filtering based on system logs. Yu teaches increasing threshold as system ages. Day teaches increasing threshold based on a binary exponential backoff. XPLG teaches log correlation. One of ordinary skill would have motivation to combine Tora, Chang, Rosie, Prasenjeet, Yu, Day, and XPLG to utilize log correlation to simplify the visualization of data flows and reduce complexity “Log correlation is a tool to reduce the weight of that complexity. It provides real ways to simplify how you visualize data flowing through your systems. When implemented correctly, it even helps your team take action proactively.” (XPLG Section “Log Correlation Lets You Focus on What’s Important” Paragraph 1).
Regarding claim 2, Tora teaches The computer-implemented method of claim 1, wherein identifying the subsequent log line as the subsequent anomalous log line utilizing the trained log anomaly model, further comprises: templatizing, by the one or more computer processors, the subsequent log line to generate a templatized subsequent log line; (Tora Paragraph 0035; “The template is composed of a template ID and a word sequence.” Tora Paragraph 0036; "the classification unit 15a compares each word sequence of a group of templates in the dictionary information stored in the storage unit 14 with each of the classified words, and when there is a template for which the word sequence matches all the words in a portion classified as non-parameter in the message, the classification unit 15a assigns the ID of the template to the message." Tora Paragraph 0065; “When messages included in the text log output from the system are acquired... Thus, the anomaly detection apparatus 10 can detect an unknown anomaly.” Examiner notes that assigning the ID of the template to the message is templatizing; Each word sequence is each classified erroneous log line and non-erroneous log line in the plurality of unlabeled log lines; Paragraph 0065 explains the flow of when a message/subsequent log line is acquired);
and matching, by the one or more computer processors, the templatized subsequent log line into one of the erroneous log template cluster or one of the non-erroneous log template cluster. (Tora Paragraph 0036; "and when there is a template for which the word sequence matches all the words in a portion classified as non-parameter in the message, the classification unit 15a assigns the ID of the template to the message." Examiner notes templatized subsequent log line is matched into appropriate template clusters based on the template IDs; ID is associated with erroneous or non-erroneous log template cluster);
Regarding claim 3, Tora teaches The computer-implemented method of claim 2, further comprising: responsive to the templatized subsequent log line failing to match into any of the one or more erroneous log template clusters, classifying, by one or more computer processors, the subsequent log line as the subsequent anomalous log line; (Tora Paragraph 0037; "In addition, when classifying a message, in the case where a template having a word sequence that matches all the words in the portion classified as non-parameter is not present in the group of templates in the dictionary information stored in the storage unit 14" Tora Paragraph 0049; "if the system is operated stably, unknown logs appear for a certain period of time in an initial stage, but the frequency of appearance of the unknown logs decreases. Then, as illustrated in FIG. 8, when an unknown event such as a failure or maintenance occurs in the system, a large amount of unknown logs appear in a predetermined period of time." Examiner notes that an unclassified/unknown event is classifying the subsequent log line as anomalous);
creating, by the one or more computer processors, a new erroneous log template cluster with the templatized subsequent log line; (Tora Paragraph 0037; "the classification unit 15a may create a new template having the word sequence based on the message and generate a new template with a new ID.");
setting, by the one or more computer processors, a frequency of the new erroneous log template cluster to one; (Tora Paragraph 0050; "the detection unit 15b counts the number of new IDs assigned per day, and monitors whether the number of new IDs assigned per day exceeds the threshold 250." Examiner notes that to count the number of new IDs/created erroneous log template cluster, the first occurrence will be tracked/set.);
and classifying, by the one or more computer processors, an occurrence of similar log lines as anomalous until the [adjusted] frequency threshold is reached (Tora Paragraph 0050; "Then, the detection unit 15b detects an anomaly when the number of new IDs assigned per day exceeds the threshold “250”. Note that the setting of the threshold can be freely changed." Examiner notes the occurrence of similar log lines are classified as an anomaly until a threshold is met/reached);
Regarding claim 4, Tora teaches The computer-implemented method of claim 2, further comprising: responsive to the templatized subsequent log line failing to match into any of the one or more non-erroneous log template clusters, classifying, by the one or more computer processors, the subsequent log line as a non-anomalous log line; (Tora Paragraph 0037; "In addition, when classifying a message, in the case where a template having a word sequence that matches all the words in the portion classified as non-parameter is not present in the group of templates in the dictionary information stored in the storage unit 14" Tora Paragraph 0049; "if the system is operated stably, unknown logs appear for a certain period of time in an initial stage, but the frequency of appearance of the unknown logs decreases. Then, as illustrated in FIG. 8, when an unknown event such as a failure or maintenance occurs in the system, a large amount of unknown logs appear in a predetermined period of time." Examiner notes that an unclassified/unknown event is classifying the subsequent log line as non-anomalous;);
creating, by the one or more computer processors, a new non-erroneous log template cluster with the templatized subsequent log line; (Tora Paragraph 0037; "the classification unit 15a may create a new template having the word sequence based on the message and generate a new template with a new ID.");
setting, by the one or more computer processors, a frequency of the new non-erroneous log template cluster to one; (Tora Paragraph 0050; "the detection unit 15b counts the number of new IDs assigned per day, and monitors whether the number of new IDs assigned per day exceeds the threshold 250." Examiner notes that to count the number of new IDs/created erroneous log template cluster, the first occurrence will be tracked/set.);
and classifying, by the one or more computer processors, an occurrence of similar log lines as non-anomalous until the [adjusted] frequency threshold and a timestamp threshold are reached (Tora Paragraph 0050; "Then, the detection unit 15b detects an anomaly when the number of new IDs assigned per day exceeds the threshold “250”. Note that the setting of the threshold can be freely changed." Examiner notes the occurrence of similar log lines are not classified as an anomaly until a threshold is met/reached)
Regarding claim 5, Tora teaches The computer-implemented method of claim 1, further comprising: implementing, by the one or more computer processors, a remedy to the subsequent anomalous log line. (Tora Paragraph 0053; "an unknown anomaly can be found early by monitoring the number of new IDs assigned per unit time, and it is possible to perform troubleshooting before the user report." Examiner notes that troubleshooting is implementing a remedy)
Regarding claim 6, Tora does not teach The computer-implemented method of claim 1, wherein the dictionary based classifier is bootstrapped utilizing a plurality of invariants and parameters identified in the software documentation and in product documentation associated with the monitored computing system.
However, Rosie does teach The computer-implemented method of claim 1, wherein the dictionary based classifier is bootstrapped utilizing a plurality of invariants and parameters identified in the software documentation and in product documentation associated with the monitored computing system. (Rosie Table 2 shows a bootstrapping algorithm to output a naïve Bayes classifier; Rosie Section 3 Paragraph 3; “Using bootstrapping techniques described in section 2, we have developed an algorithm that can learn dictionaries for information extraction without any special training resources.” Rosie Section 4.3 Paragraph 1; “As a test domain, we use computer science research papers.” Examiner notes that the bootstrapping uses computer science research papers which include a plurality of invariants and parameters (information in) software documentation and in product documentation associated with the monitored computing system as shown in Figure 5; bootstrapping techniques learn dictionaries making the classifier dictionary based)
It would have obvious to one of ordinary skill in the art before the effective filing date of the present application to combine Tora, Chang, and Rosie. Tora teaches an anomaly detection apparatus that uses dictionary based classifier to classify the text logs. Chang teaches the benefits of using a plurality of sub-classifiers in a hybrid classifier to classify an object in an image. Rosie teaches bootstrapping for text learning tasks. One of ordinary skill would have motivation to combine Tora, Chang, and Rosie to utilize bootstrapping techniques to gain semantic lexicon and extraction patterns without special training resources “Our bootstrapping approach has two advantages over previous techniques for learning information extraction dictionaries: both a semantic lexicon and a dictionary of extraction patterns are acquired simultaneously, and no special training resources are needed” (Rosie 1 Paragraph prior to Section 4).
Regarding claim 8, Tora teaches A computer program product comprising: one or more computer readable storage media and program instructions stored on the one or more computer readable storage media, wherein the stored program instructions, when executed by one or more computer processors, cause the one or more computer processors to: (Tora Paragraph 0033; " the control unit 15 includes an internal memory for storing programs or control data that define various processing procedures, and executes each processing operation using the internal memory.")
Classify each log line in a plurality of unlabeled log lines as a classified erroneous log line or a classified non-erroneous log line utilizing a dictionary based classifier [within a hybrid error classifier]; (Tora Paragraph 0034; " the classification unit 15a refers to dictionary information stored in the storage unit 14, classifies the messages included in the text log by type, and assigns an ID to each of the classified messages." Tora Paragraph 0048; “the detection unit 15b detects an anomaly based on the ID assigned to the message by the classification unit 15a.” Examiner notes that the message is the log line and is classified using a dictionary based classifier as an ID; The ID is used to determine if the message is a classified erroneous or non-erroneous log line (anomaly));
wherein each of the plurality of unlabeled log lines log line is respectively associated with streaming real-time operations of a monitored computing system; (Tora Paragraph 0030; "The text log is, for example, an OS syslog, an application and database execution log, an error log, an operating log, MIB information obtained from a network device, a monitoring system alert, a behavior log, an operating state log, or the like." Tora Paragraph 0031; "As illustrated in FIG. 2, each record of the text log includes a message and an occurrence date and time attached to the message. For example, a record on the first line of the text log includes the message “LINK-UP Interface 1/0/17” and the occurrence date and time “2015/05/18 T14:56”." Examiner notes that each log line (text log) is respectively associated with streaming real-time operations of a monitored computing system)
thereby identifying, from the plurality of unlabeled log lines, one or more classified erroneous log lines and one or more classified non-erroneous log lines (Tora Paragraph 0034; " the classification unit 15a refers to dictionary information stored in the storage unit 14, classifies the messages included in the text log by type, and assigns an ID to each of the classified messages." Tora Paragraph 0048; “the detection unit 15b detects an anomaly based on the ID assigned to the message by the classification unit 15a.” Examiner notes that the message is the log line and is classified using a dictionary based classifier as an ID; The ID is used to determine if the message is a classified erroneous or non-erroneous log line (anomaly))
templatize the one or more classified erroneous log line and the one or more non-erroneous log line in the plurality of unlabeled log lines to generate erroneous log templates and non-erroneous log templates; (Tora Paragraph 0036; "the classification unit 15a compares each word sequence of a group of templates in the dictionary information stored in the storage unit 14 with each of the classified words, and when there is a template for which the word sequence matches all the words in a portion classified as non-parameter in the message, the classification unit 15a assigns the ID of the template to the message." Tora Paragraph 0044; “when a template having the word sequence that matches the message is not present in the dictionary information 14b, the classification unit 15a assigns a new ID that has not yet been assigned, and adds a new template to the dictionary information 14b based on the message.” Tora Paragraph 0064; “if the number of new templates per unit time exceeds the predetermined number (Yes in step S107), the detection unit 15b detects an anomaly (step S108).” Examiner notes that assigning the ID or creating new ID of the template to the message is templatizing to generate erroneous and non-erroneous log templates; classified erroneous log lines have a template with new ID detected as an anomaly and non-erroneous log lines have a template with ID not detected as an anomaly; Each word sequence is each classified erroneous log line and non-erroneous log line in the plurality of unlabeled log lines);
wherein templatizing comprises preserving log line invariants and replacing log line parameters with a respective token; (Tora Paragraph 0036; "Further, the classification unit 15a compares each word sequence of a group of templates in the dictionary information stored in the storage unit 14 with each of the classified words, and when there is a template for which the word sequence matches all the words in a portion classified as non-parameter in the message, the classification unit 15a assigns the ID of the template to the message." Tora Paragraph 0038; "At this time, the classification unit 15a may add a wild card such as “*” to the portion where the parameter has been deleted." Examiner notes that log line invariants (non-parameter words) is preserved in the template (word sequence) and log line parameters (parameter) is replaced with a respective token ("*"))
cluster the erroneous log templates into erroneous log template clusters and the non-erroneous log templates into non-erroneous log template clusters; (Tora Paragraph 0036; "the classification unit 15a compares each word sequence of a group of templates in the dictionary information stored in the storage unit 14 with each of the classified words, and when there is a template for which the word sequence matches all the words in a portion classified as non-parameter in the message, the classification unit 15a assigns the ID of the template to the message." Examiner notes that the erroneous and non-erroneous log templates are clustered into appropriate template clusters based on the template IDs);
identify a subsequent log line as a subsequent anomalous log line utilizing the trained log anomaly model. (Tora Paragraph 0052; "As illustrated in FIG. 9, for a new log output from a system in which an anomaly has occurred, the anomaly detection apparatus 10 refers to the dictionary information 14b stored in the storage unit 14, and assigns a new ID to the message of the text log that is not registered in the dictionary information." Tora Paragraph 0062; “when the classification unit 15a of the anomaly detection apparatus 10 receives a log message (Yes in step S101),” Tora Paragraph 0064; “if the number of new templates per unit time exceeds the predetermined number (Yes in step S107), the detection unit 15b detects an anomaly (step S108).” Examiner notes that new log output from a system is subsequent log line; the anomaly detection apparatus is the trained log anomaly model that identifies a subsequent log line as a subsequent anomalous log line (detection unit 15b detects an anomaly))
PNG
media_image1.png
774
432
media_image1.png
Greyscale
adjust, responsive to identifying the cause, computational resources associated with the monitored computing system. (Tora Paragraph 0053; "an unknown anomaly can be found early by monitoring the number of new IDs assigned per unit time, and it is possible to perform troubleshooting before the user report." Examiner notes that responsive to identifying, the computational resources associated with the monitored computing system is adjusted (perform troubleshooting))
Tora does not teach within a hybrid error classifier. However, Chang does teach within a hybrid error classifier (Chang Paragraph 0029; "Several sub-classifiers may be used as input to a hybrid classifier." Examiner notes that a dictionary based classifier within a hybrid error classifier is one of the several sub classifiers in the hybrid classifier)
It would have obvious to one of ordinary skill in the art before the effective filing date of the present application to combine Tora and Chang. Tora teaches an anomaly detection apparatus that uses dictionary based classifier to classify the text logs. Chang teaches the benefits of using a plurality of sub-classifiers in a hybrid classifier to classify an object in an image. One of ordinary skill would have motivation to combine Tora and Chang to include a hybrid classifier that includes dictionary based classifier for the robustness in performance “FIG. 11 shows the error rate of the hybrid classifiers on the testing set. The performance on the testing set has thus been found to be comparable to the performance on the training set, indicative of the robustness of this approach.” (Chang Paragraph 0041).
Tora in view of Chang does not teach and wherein the dictionary based classifier is bootstrapped from software documentation associated with the monitored computing system, [thereby identifying, from the plurality of unlabeled log lines, one or more classified erroneous log lines and one or more classified non-erroneous log lines]
However, Rosie does teach and wherein the dictionary based classifier is bootstrapped from software documentation associated with the monitored computing system, [thereby identifying, from the plurality of unlabeled log lines, one or more classified erroneous log lines and one or more classified non-erroneous log lines]; (Rosie Table 2 shows a bootstrapping algorithm to output a naïve Bayes classifier; Rosie Section 3 Paragraph 3; “Using bootstrapping techniques described in section 2, we have developed an algorithm that can learn dictionaries for information extraction without any special training resources.” Rosie Section 4.3 Paragraph 1; “As a test domain, we use computer science research papers.” Examiner notes that the bootstrapping uses computer science research papers which include software documentation associated with the monitored computing system as shown in Figure 5; bootstrapping techniques learn dictionaries making the classifier dictionary based)
PNG
media_image2.png
434
387
media_image2.png
Greyscale
PNG
media_image3.png
333
790
media_image3.png
Greyscale
It would have obvious to one of ordinary skill in the art before the effective filing date of the present application to combine Tora, Chang, and Rosie. Tora teaches an anomaly detection apparatus that uses dictionary based classifier to classify the text logs. Chang teaches the benefits of using a plurality of sub-classifiers in a hybrid classifier to classify an object in an image. Rosie teaches bootstrapping for text learning tasks. One of ordinary skill would have motivation to combine Tora, Chang, and Rosie to utilize bootstrapping techniques to gain semantic lexicon and extraction patterns without special training resources “Our bootstrapping approach has two advantages over previous techniques for learning information extraction dictionaries: both a semantic lexicon and a dictionary of extraction patterns are acquired simultaneously, and no special training resources are needed” (Rosie 1 Paragraph prior to Section 4).
Tora in view of Chang in further view of Rosie does not teach remove the erroneous log template clusters and the non-erroneous log template clusters that exceed a frequency threshold;
Generate an adjusted frequency threshold in response to the removing, wherein generating the adjusted frequency threshold comprises, adjusting the frequency threshold based on a maturity level of the monitored computing system, and wherein the adjusted frequency threshold increases exponentially as the maturity level increases;
Identify one or more of the plurality of unlabeled log lines that do not exceed the adjusted frequency threshold as one or more anomalous log lines
Train a log anomaly model within the hybrid error classifier utilizing one or more anomalous log lines, thereby generating a trained log anomaly model
However, Prasenjeet does teach remove the erroneous log template clusters and the non-erroneous log template clusters that exceed a frequency threshold; (Prasenjeet Paragraph 0039; "the plurality of log templates included in the dictionary is updated during operation of the machine learning model to remove log templates no longer observed in actual log templates from the system by removing operational logs that were added during a particular time range (e.g., to roll back a system change, in response to detecting a security threat that was active during the time range) or that have not been observed in a given length of time (e.g., as network conditions change)." Examiner notes that erroneous and non-erroneous log template clusters are removed when a frequency threshold is exceeded (has not been observed in a given length of time))
Generate an [adjusted] frequency threshold in response to the removing, [wherein generating the adjusted frequency threshold comprises, adjusting the frequency threshold based on a maturity level of the monitored computing system, and wherein the adjusted frequency threshold increases exponentially as the maturity level increases;] (Prasenjeet Paragraph 0039; “The operator maintains the machine learning model and dictionary of log templates based on changing network conditions to better recognize new templates that were once anomalous, but are now commonplace, or that where once commonplace, but are now anomalous… In another example, the plurality of log templates included in the dictionary is updated during operation of the machine learning model to remove log templates no longer observed in actual log templates from the system by removing operational logs that were added during a particular time range (e.g., to roll back a system change, in response to detecting a security threat that was active during the time range) or that have not been observed in a given length of time (e.g., as network conditions change).” Examiner notes that a frequency threshold (given length of time maintained my operator) is generated/maintained in response to the removing)
Identify one or more of the plurality of unlabeled log lines that do not exceed the [adjusted] frequency threshold as one or more anomalous log lines (Prasenjeet Paragraph 0039; "The operator maintains the machine learning model and dictionary of log templates based on changing network conditions to better recognize new templates that were once anomalous, but are now commonplace, or that where once commonplace, but are now anomalous… the plurality of log templates included in the dictionary is updated during operation of the machine learning model to remove log templates no longer observed in actual log templates from the system by removing operational logs that were added during a particular time range (e.g., to roll back a system change, in response to detecting a security threat that was active during the time range) or that have not been observed in a given length of time (e.g., as network conditions change)." Examiner notes that if the unlabeled log lines (logs seen as commonplace) did not exceed the frequency threshold (was observed within particular time range) then they are identified as anomalous (still identified as anomalous and not commonplace))
Train a log anomaly model within the hybrid error classifier utilizing one or more anomalous log lines, thereby generating a trained log anomaly model (Prasenjeet Paragraph 0024; “The anomaly detection model 240 is fitted based on the training logs 210a to identify patterns in the network behavior as indicated in the logs 210. The anomaly detection model 240 determines whether a given log entry is anomalous as a seq2seq (sequence to sequence) prediction problem.” Examiner notes that log anomaly model (anomaly detection model) is trained utilizing one or more anomalous log lines (training logs))
It would have obvious to one of ordinary skill in the art before the effective filing date of the present application to combine Tora, Chang, Rosie, and Prasenjeet. Tora teaches an anomaly detection apparatus that uses dictionary based classifier to classify the text logs. Chang teaches the benefits of using a plurality of sub-classifiers in a hybrid classifier to classify an object in an image. Rosie teaches bootstrapping for text learning tasks. Prasenjeet teaches anomaly detection and filtering based on system logs. One of ordinary skill would have motivation to combine Tora, Chang, Rosie, and Prasenjeet to remove log templates when not used for a period of time to improve efficiency and accuracy of reports “Accordingly, the present disclosure provides for improvements in the efficiency and accuracy of reporting network anomalies, and reduces the incidence of false positive or extraneous anomaly reports, among other benefits.” (Prasenjeet Paragraph 0014).
Tora in view of Chang in further view of Rosie in further view of Prasenjeet does not teach wherein generating the adjusted [frequency] threshold comprises, adjusting the [frequency] threshold based on a maturity level of the monitored computing system, and wherein the adjusted [frequency] threshold increases [exponentially] as the maturity level increases;
However, Yu does teach wherein generating the adjusted [frequency] threshold comprises, adjusting the [frequency] threshold based on a maturity level of the monitored computing system, and wherein the adjusted [frequency] threshold increases [exponentially] as the maturity level increases; (Yu Paragraph 0084; “The WLC threshold is increased over time, such as each time that a WLC swap occurs. The WLC threshold is initially much smaller than the BBN threshold, but as the system ages, the WLC threshold becomes larger.” Examiner notes that the threshold is adjusted based on a maturity level of the monitored computing system (as the system ages), and wherein the adjusted threshold increases as the maturity level increases (as the system ages, the WLC threshold becomes larger; as seen in Fig 8))
PNG
media_image4.png
240
496
media_image4.png
Greyscale
It would have obvious to one of ordinary skill in the art before the effective filing date of the present application to combine Tora, Chang, Rosie, Prasenjeet, and Yu. Tora teaches an anomaly detection apparatus that uses dictionary based classifier to classify the text logs. Chang teaches the benefits of using a plurality of sub-classifiers in a hybrid classifier to classify an object in an image. Rosie teaches bootstrapping for text learning tasks. Prasenjeet teaches anomaly detection and filtering based on system logs. Yu teaches increasing threshold as system ages. One of ordinary skill would have motivation to combine Tora, Chang, Rosie, Prasenjeet, and Yu to improve the fault tolerance of a system “The overall system fault tolerance is significantly improved.” (Yu Paragraph 0130).
Tora in view of Chang in further view of Rosie in further view of Prasenjeet in further view of Yu does not teach threshold increases exponentially
However, Day does teach threshold increases exponentially (Day Claim 12; “wherein the recurrence threshold is increased according to a binary exponential backoff algorithm;” Examiner notes that threshold increases exponentially (threshold is increased according to a binary exponential backoff algorithm))
It would have obvious to one of ordinary skill in the art before the effective filing date of the present application to combine Tora, Chang, Rosie, Prasenjeet, Yu, and Day. Tora teaches an anomaly detection apparatus that uses dictionary based classifier to classify the text logs. Chang teaches the benefits of using a plurality of sub-classifiers in a hybrid classifier to classify an object in an image. Rosie teaches bootstrapping for text learning tasks. Prasenjeet teaches anomaly detection and filtering based on system logs. Yu teaches increasing threshold as system ages. Day teaches increasing threshold based on a binary exponential backoff. One of ordinary skill would have motivation to combine Tora, Chang, Rosie, Prasenjeet, Yu, and Day to adjust the threshold to a match it to a level consistent with normal usage, and mitigate harmful effects “Such restricting, or throttling, does not absolutely prevent the user from connecting, but reduces it to a level consistent with normal usage, thus mitigating any harmful effects due to rapid connection attempts.” (Day Column 3 Line 47).
Tora in view of Chang in further view of Rosie in further view of Prasenjeet in further view of Yu in further view of Day does not teach identify a cause for the subsequent anomalous log line by identifying an additional anomalous log line associated with a different computing environment that is correlated to the subsequent anomalous log line;
However, XPLG does teach identify a cause for the subsequent anomalous log line by identifying an anomalous log line associated with another environment that is correlated to the subsequent anomalous log line; (XPLG Section "Tying the Threads Together" Paragraph 1; "It’s able to track actions throughout your system and trace the logs they generate. That’s the “correlate” part of log correlation. Under the hood, log correlation is a terrific bit of engineering. Application programmers build pattern-matching software which is able to direct the software to determine which parts of disparate logs represent the same action." XPLG Section "Working Automatically With Different Systems" Paragraph 1; "You’re able to quickly and smoothly determine how a bug traced through your system, and root out the cause in minutes. What’s more, slight configuration differences in systems can cause big problems in log collection." Examiner notes that identifying a cause for the subsequent anomalous log line by identifying an anomalous log line (track actions/logs to root cause) associated with a different computing environment (older version of system) that is correlated to the subsequent anomalous log line (track actions throughout your system and trace the logs they generate))
It would have obvious to one of ordinary skill in the art before the effective filing date of the present application to combine Tora, Chang, Rosie, Prasenjeet, Yu, Day, and XPLG. Tora teaches an anomaly detection apparatus that uses dictionary based classifier to classify the text logs. Chang teaches the benefits of using a plurality of sub-classifiers in a hybrid classifier to classify an object in an image. Rosie teaches bootstrapping for text learning tasks. Prasenjeet teaches anomaly detection and filtering based on system logs. Yu teaches increasing threshold as system ages. Day teaches increasing threshold based on a binary exponential backoff. XPLG teaches log correlation. One of ordinary skill would have motivation to combine Tora, Chang, Rosie, Prasenjeet, Yu, Day, and XPLG to utilize log correlation to simplify the visualization of data flows and reduce complexity “Log correlation is a tool to reduce the weight of that complexity. It provides real ways to simplify how you visualize data flowing through your systems. When implemented correctly, it even helps your team take action proactively.” (XPLG Section “Log Correlation Lets You Focus on What’s Important” Paragraph 1).
Regarding claim 9, Tora teaches The computer program product of claim 8, wherein identifying the subsequent log line as the subsequent anomalous log line utilizing the trained log anomaly model, comprises causing the one or more computer processors to: templatize the subsequent log line to generate a templatized subsequent log line; (Tora Paragraph 0035; “The template is composed of a template ID and a word sequence.” Tora Paragraph 0036; "the classification unit 15a compares each word sequence of a group of templates in the dictionary information stored in the storage unit 14 with each of the classified words, and when there is a template for which the word sequence matches all the words in a portion classified as non-parameter in the message, the classification unit 15a assigns the ID of the template to the message." Tora Paragraph 0065; “When messages included in the text log output from the system are acquired... Thus, the anomaly detection apparatus 10 can detect an unknown anomaly.” Examiner notes that assigning the ID of the template to the message is templatizing; Each word sequence is each classified erroneous log line and non-erroneous log line in the plurality of unlabeled log lines; Paragraph 0065 explains the flow of when a message/subsequent log line is acquired);
and match the templatized subsequent log line into one of the erroneous log template cluster or one of the non-erroneous log template cluster. (Tora Paragraph 0036; "and when there is a template for which the word sequence matches all the words in a portion classified as non-parameter in the message, the classification unit 15a assigns the ID of the template to the message." Examiner notes templatized subsequent log line is matched into appropriate template clusters based on the template IDs; ID is associated with erroneous or non-erroneous log template cluster);
Regarding claim 10, Tora teaches The computer program product of claim 9, wherein the stored program instructions, when executed by the one or more computer processors, further cause the one or more computer processors to: responsive to the templatized subsequent log line failing to match into any of the erroneous log template clusters, classify the subsequent log line as the subsequent anomalous log line; (Tora Paragraph 0037; "In addition, when classifying a message, in the case where a template having a word sequence that matches all the words in the portion classified as non-parameter is not present in the group of templates in the dictionary information stored in the storage unit 14" Tora Paragraph 0049; "if the system is operated stably, unknown logs appear for a certain period of time in an initial stage, but the frequency of appearance of the unknown logs decreases. Then, as illustrated in FIG. 8, when an unknown event such as a failure or maintenance occurs in the system, a large amount of unknown logs appear in a predetermined period of time." Examiner notes that an unclassified/unknown event is classifying the subsequent log line as anomalous);
Create a new erroneous log template cluster with the templatized subsequent log line; (Tora Paragraph 0037; "the classification unit 15a may create a new template having the word sequence based on the message and generate a new template with a new ID.");
Set a frequency of the new erroneous log template cluster to one; (Tora Paragraph 0050; "the detection unit 15b counts the number of new IDs assigned per day, and monitors whether the number of new IDs assigned per day exceeds the threshold 250." Examiner notes that to count the number of new IDs/created erroneous log template cluster, the first occurrence will be tracked/set.);
and classify an occurrence of similar log lines as anomalous until the [adjusted] frequency threshold is reached (Tora Paragraph 0050; "Then, the detection unit 15b detects an anomaly when the number of new IDs assigned per day exceeds the threshold “250”. Note that the setting of the threshold can be freely changed." Examiner notes the occurrence of similar log lines are classified as an anomaly until a threshold is met/reached);
Regarding claim 11, Tora teaches The computer program product of claim 9, wherein stored program instructions, when executed by the one or more computer processors, further cause the one or more computer processors to: responsive to the templatized subsequent log line failing to match into any of the one or more non-erroneous log template clusters, classify the subsequent log line as a non-anomalous log line; (Tora Paragraph 0037; "In addition, when classifying a message, in the case where a template having a word sequence that matches all the words in the portion classified as non-parameter is not present in the group of templates in the dictionary information stored in the storage unit 14" Tora Paragraph 0049; "if the system is operated stably, unknown logs appear for a certain period of time in an initial stage, but the frequency of appearance of the unknown logs decreases. Then, as illustrated in FIG. 8, when an unknown event such as a failure or maintenance occurs in the system, a large amount of unknown logs appear in a predetermined period of time." Examiner notes that an unclassified/unknown event is classifying the subsequent log line as non-anomalous;);
Create a new non-erroneous log template cluster with the templatized subsequent log line; (Tora Paragraph 0037; "the classification unit 15a may create a new template having the word sequence based on the message and generate a new template with a new ID.");
Set a frequency of the new non-erroneous log template cluster to one; (Tora Paragraph 0050; "the detection unit 15b counts the number of new IDs assigned per day, and monitors whether the number of new IDs assigned per day exceeds the threshold 250." Examiner notes that to count the number of new IDs/created erroneous log template cluster, the first occurrence will be tracked/set.);
and classify an occurrence of similar log lines as non-anomalous until the [adjusted] frequency threshold and a timestamp threshold are reached (Tora Paragraph 0050; "Then, the detection unit 15b detects an anomaly when the number of new IDs assigned per day exceeds the threshold “250”. Note that the setting of the threshold can be freely changed." Examiner notes the occurrence of similar log lines are not classified as an anomaly until a threshold is met/reached)
Regarding claim 12, Tora teaches The computer program product of claim 8, wherein stored program instructions, when executed by the one or more computer processors, further cause the one or more computer processors to: implement a remedy to the subsequent anomalous log line. (Tora Paragraph 0053; "an unknown anomaly can be found early by monitoring the number of new IDs assigned per unit time, and it is possible to perform troubleshooting before the user report." Examiner notes that troubleshooting is implementing a remedy)
Regarding claim 13, Tora does not teach The computer program product of claim 8, wherein the dictionary based classifier is bootstrapped utilizing a plurality of invariants and parameters identified in the software documentation and in product documentation associated with the monitored computing system.
However, Rosie does teach The computer-implemented method of claim 1, wherein the dictionary based classifier is bootstrapped utilizing a plurality of invariants and parameters identified in the software documentation and in product documentation associated with the monitored computing system. (Rosie Table 2 shows a bootstrapping algorithm to output a naïve Bayes classifier; Rosie Section 3 Paragraph 3; “Using bootstrapping techniques described in section 2, we have developed an algorithm that can learn dictionaries for information extraction without any special training resources.” Rosie Section 4.3 Paragraph 1; “As a test domain, we use computer science research papers.” Examiner notes that the bootstrapping uses computer science research papers which include a plurality of invariants and parameters (information in) software documentation and in product documentation associated with the monitored computing system as shown in Figure 5; bootstrapping techniques learn dictionaries making the classifier dictionary based)
It would have obvious to one of ordinary skill in the art before the effective filing date of the present application to combine Tora, Chang, and Rosie. Tora teaches an anomaly detection apparatus that uses dictionary based classifier to classify the text logs. Chang teaches the benefits of using a plurality of sub-classifiers in a hybrid classifier to classify an object in an image. Rosie teaches bootstrapping for text learning tasks. One of ordinary skill would have motivation to combine Tora, Chang, and Rosie to utilize bootstrapping techniques to gain semantic lexicon and extraction patterns without special training resources “Our bootstrapping approach has two advantages over previous techniques for learning information extraction dictionaries: both a semantic lexicon and a dictionary of extraction patterns are acquired simultaneously, and no special training resources are needed” (Rosie 1 Paragraph prior to Section 4).
Regarding claim 15, Tora teaches A computer system comprising: one or more computer processors; one or more computer readable storage media; and program instructions stored on the one or more computer readable storage media wherein the stored program instructions, when executed by the one or more computer processors, cause the one or more computer processors to: (Tora Paragraph 0033; " The control unit 15 is, for example, an electronic circuit such as a central processing unit (CPU)… the control unit 15 includes an internal memory for storing programs or control data that define various processing procedures, and executes each processing operation using the internal memory.")
Classify each log line in a plurality of unlabeled log lines as a classified erroneous log line or a classified non-erroneous log line utilizing a dictionary based classifier [within a hybrid error classifier]; (Tora Paragraph 0034; " the classification unit 15a refers to dictionary information stored in the storage unit 14, classifies the messages included in the text log by type, and assigns an ID to each of the classified messages." Tora Paragraph 0048; “the detection unit 15b detects an anomaly based on the ID assigned to the message by the classification unit 15a.” Examiner notes that the message is the log line and is classified using a dictionary based classifier as an ID; The ID is used to determine if the message is a classified erroneous or non-erroneous log line (anomaly));
wherein each of the plurality of unlabeled log lines log line is respectively associated with streaming real-time operations of a monitored computing system; (Tora Paragraph 0030; "The text log is, for example, an OS syslog, an application and database execution log, an error log, an operating log, MIB information obtained from a network device, a monitoring system alert, a behavior log, an operating state log, or the like." Tora Paragraph 0031; "As illustrated in FIG. 2, each record of the text log includes a message and an occurrence date and time attached to the message. For example, a record on the first line of the text log includes the message “LINK-UP Interface 1/0/17” and the occurrence date and time “2015/05/18 T14:56”." Examiner notes that each log line (text log) is respectively associated with streaming real-time operations of a monitored computing system)
thereby identifying, from the plurality of unlabeled log lines, one or more classified erroneous log lines and one or more classified non-erroneous log lines (Tora Paragraph 0034; " the classification unit 15a refers to dictionary information stored in the storage unit 14, classifies the messages included in the text log by type, and assigns an ID to each of the classified messages." Tora Paragraph 0048; “the detection unit 15b detects an anomaly based on the ID assigned to the message by the classification unit 15a.” Examiner notes that the message is the log line and is classified using a dictionary based classifier as an ID; The ID is used to determine if the message is a classified erroneous or non-erroneous log line (anomaly))
templatize the one or more classified erroneous log line and the one or more non-erroneous log line in the plurality of unlabeled log lines to generate erroneous log templates and non-erroneous log templates; (Tora Paragraph 0036; "the classification unit 15a compares each word sequence of a group of templates in the dictionary information stored in the storage unit 14 with each of the classified words, and when there is a template for which the word sequence matches all the words in a portion classified as non-parameter in the message, the classification unit 15a assigns the ID of the template to the message." Tora Paragraph 0044; “when a template having the word sequence that matches the message is not present in the dictionary information 14b, the classification unit 15a assigns a new ID that has not yet been assigned, and adds a new template to the dictionary information 14b based on the message.” Tora Paragraph 0064; “if the number of new templates per unit time exceeds the predetermined number (Yes in step S107), the detection unit 15b detects an anomaly (step S108).” Examiner notes that assigning the ID or creating new ID of the template to the message is templatizing to generate erroneous and non-erroneous log templates; classified erroneous log lines have a template with new ID detected as an anomaly and non-erroneous log lines have a template with ID not detected as an anomaly; Each word sequence is each classified erroneous log line and non-erroneous log line in the plurality of unlabeled log lines);
wherein templatizing comprises preserving log line invariants and replacing log line parameters with a respective token; (Tora Paragraph 0036; "Further, the classification unit 15a compares each word sequence of a group of templates in the dictionary information stored in the storage unit 14 with each of the classified words, and when there is a template for which the word sequence matches all the words in a portion classified as non-parameter in the message, the classification unit 15a assigns the ID of the template to the message." Tora Paragraph 0038; "At this time, the classification unit 15a may add a wild card such as “*” to the portion where the parameter has been deleted." Examiner notes that log line invariants (non-parameter words) is preserved in the template (word sequence) and log line parameters (parameter) is replaced with a respective token ("*"))
cluster the erroneous log templates into erroneous log template clusters and the non-erroneous log templates into non-erroneous log template clusters; (Tora Paragraph 0036; "the classification unit 15a compares each word sequence of a group of templates in the dictionary information stored in the storage unit 14 with each of the classified words, and when there is a template for which the word sequence matches all the words in a portion classified as non-parameter in the message, the classification unit 15a assigns the ID of the template to the message." Examiner notes that the erroneous and non-erroneous log templates are clustered into appropriate template clusters based on the template IDs);
identify a subsequent log line as a subsequent anomalous log line utilizing the trained log anomaly model. (Tora Paragraph 0052; "As illustrated in FIG. 9, for a new log output from a system in which an anomaly has occurred, the anomaly detection apparatus 10 refers to the dictionary information 14b stored in the storage unit 14, and assigns a new ID to the message of the text log that is not registered in the dictionary information." Tora Paragraph 0062; “when the classification unit 15a of the anomaly detection apparatus 10 receives a log message (Yes in step S101),” Tora Paragraph 0064; “if the number of new templates per unit time exceeds the predetermined number (Yes in step S107), the detection unit 15b detects an anomaly (step S108).” Examiner notes that new log output from a system is subsequent log line; the anomaly detection apparatus is the trained log anomaly model that identifies a subsequent log line as a subsequent anomalous log line (detection unit 15b detects an anomaly))
PNG
media_image1.png
774
432
media_image1.png
Greyscale
adjust, responsive to identifying the cause, computational resources associated with the monitored computing system. (Tora Paragraph 0053; "an unknown anomaly can be found early by monitoring the number of new IDs assigned per unit time, and it is possible to perform troubleshooting before the user report." Examiner notes that responsive to identifying, the computational resources associated with the monitored computing system is adjusted (perform troubleshooting))
Tora does not teach within a hybrid error classifier. However, Chang does teach within a hybrid error classifier (Chang Paragraph 0029; "Several sub-classifiers may be used as input to a hybrid classifier." Examiner notes that a dictionary based classifier within a hybrid error classifier is one of the several sub classifiers in the hybrid classifier)
It would have obvious to one of ordinary skill in the art before the effective filing date of the present application to combine Tora and Chang. Tora teaches an anomaly detection apparatus that uses dictionary based classifier to classify the text logs. Chang teaches the benefits of using a plurality of sub-classifiers in a hybrid classifier to classify an object in an image. One of ordinary skill would have motivation to combine Tora and Chang to include a hybrid classifier that includes dictionary based classifier for the robustness in performance “FIG. 11 shows the error rate of the hybrid classifiers on the testing set. The performance on the testing set has thus been found to be comparable to the performance on the training set, indicative of the robustness of this approach.” (Chang Paragraph 0041).
Tora in view of Chang does not teach and wherein the dictionary based classifier is bootstrapped from software documentation associated with the monitored computing system, [thereby identifying, from the plurality of unlabeled log lines, one or more classified erroneous log lines and one or more classified non-erroneous log lines]
However, Rosie does teach and wherein the dictionary based classifier is bootstrapped from software documentation associated with the monitored computing system, [thereby identifying, from the plurality of unlabeled log lines, one or more classified erroneous log lines and one or more classified non-erroneous log lines]; (Rosie Table 2 shows a bootstrapping algorithm to output a naïve Bayes classifier; Rosie Section 3 Paragraph 3; “Using bootstrapping techniques described in section 2, we have developed an algorithm that can learn dictionaries for information extraction without any special training resources.” Rosie Section 4.3 Paragraph 1; “As a test domain, we use computer science research papers.” Examiner notes that the bootstrapping uses computer science research papers which include software documentation associated with the monitored computing system as shown in Figure 5; bootstrapping techniques learn dictionaries making the classifier dictionary based)
PNG
media_image2.png
434
387
media_image2.png
Greyscale
PNG
media_image3.png
333
790
media_image3.png
Greyscale
It would have obvious to one of ordinary skill in the art before the effective filing date of the present application to combine Tora, Chang, and Rosie. Tora teaches an anomaly detection apparatus that uses dictionary based classifier to classify the text logs. Chang teaches the benefits of using a plurality of sub-classifiers in a hybrid classifier to classify an object in an image. Rosie teaches bootstrapping for text learning tasks. One of ordinary skill would have motivation to combine Tora, Chang, and Rosie to utilize bootstrapping techniques to gain semantic lexicon and extraction patterns without special training resources “Our bootstrapping approach has two advantages over previous techniques for learning information extraction dictionaries: both a semantic lexicon and a dictionary of extraction patterns are acquired simultaneously, and no special training resources are needed” (Rosie 1 Paragraph prior to Section 4).
Tora in view of Chang in further view of Rosie does not teach remove the erroneous log template clusters and the non-erroneous log template clusters that exceed a frequency threshold;
Generate an adjusted frequency threshold in response to the removing, wherein generating the adjusted frequency threshold comprises, adjusting the frequency threshold based on a maturity level of the monitored computing system, and wherein the adjusted frequency threshold increases exponentially as the maturity level increases;
Identify one or more of the plurality of unlabeled log lines that do not exceed the adjusted frequency threshold as one or more anomalous log lines
Train a log anomaly model within the hybrid error classifier utilizing one or more anomalous log lines, thereby generating a trained log anomaly model
However, Prasenjeet does teach remove the erroneous log template clusters and the non-erroneous log template clusters that exceed a frequency threshold; (Prasenjeet Paragraph 0039; "the plurality of log templates included in the dictionary is updated during operation of the machine learning model to remove log templates no longer observed in actual log templates from the system by removing operational logs that were added during a particular time range (e.g., to roll back a system change, in response to detecting a security threat that was active during the time range) or that have not been observed in a given length of time (e.g., as network conditions change)." Examiner notes that erroneous and non-erroneous log template clusters are removed when a frequency threshold is exceeded (has not been observed in a given length of time))
Generate an [adjusted] frequency threshold in response to the removing, [wherein generating the adjusted frequency threshold comprises, adjusting the frequency threshold based on a maturity level of the monitored computing system, and wherein the adjusted frequency threshold increases exponentially as the maturity level increases;] (Prasenjeet Paragraph 0039; “The operator maintains the machine learning model and dictionary of log templates based on changing network conditions to better recognize new templates that were once anomalous, but are now commonplace, or that where once commonplace, but are now anomalous… In another example, the plurality of log templates included in the dictionary is updated during operation of the machine learning model to remove log templates no longer observed in actual log templates from the system by removing operational logs that were added during a particular time range (e.g., to roll back a system change, in response to detecting a security threat that was active during the time range) or that have not been observed in a given length of time (e.g., as network conditions change).” Examiner notes that a frequency threshold (given length of time maintained my operator) is generated/maintained in response to the removing)
Identify one or more of the plurality of unlabeled log lines that do not exceed the [adjusted] frequency threshold as one or more anomalous log lines (Prasenjeet Paragraph 0039; "The operator maintains the machine learning model and dictionary of log templates based on changing network conditions to better recognize new templates that were once anomalous, but are now commonplace, or that where once commonplace, but are now anomalous… the plurality of log templates included in the dictionary is updated during operation of the machine learning model to remove log templates no longer observed in actual log templates from the system by removing operational logs that were added during a particular time range (e.g., to roll back a system change, in response to detecting a security threat that was active during the time range) or that have not been observed in a given length of time (e.g., as network conditions change)." Examiner notes that if the unlabeled log lines (logs seen as commonplace) did not exceed the frequency threshold (was observed within particular time range) then they are identified as anomalous (still identified as anomalous and not commonplace))
Train a log anomaly model within the hybrid error classifier utilizing one or more anomalous log lines, thereby generating a trained log anomaly model (Prasenjeet Paragraph 0024; “The anomaly detection model 240 is fitted based on the training logs 210a to identify patterns in the network behavior as indicated in the logs 210. The anomaly detection model 240 determines whether a given log entry is anomalous as a seq2seq (sequence to sequence) prediction problem.” Examiner notes that log anomaly model (anomaly detection model) is trained utilizing one or more anomalous log lines (training logs))
It would have obvious to one of ordinary skill in the art before the effective filing date of the present application to combine Tora, Chang, Rosie, and Prasenjeet. Tora teaches an anomaly detection apparatus that uses dictionary based classifier to classify the text logs. Chang teaches the benefits of using a plurality of sub-classifiers in a hybrid classifier to classify an object in an image. Rosie teaches bootstrapping for text learning tasks. Prasenjeet teaches anomaly detection and filtering based on system logs. One of ordinary skill would have motivation to combine Tora, Chang, Rosie, and Prasenjeet to remove log templates when not used for a period of time to improve efficiency and accuracy of reports “Accordingly, the present disclosure provides for improvements in the efficiency and accuracy of reporting network anomalies, and reduces the incidence of false positive or extraneous anomaly reports, among other benefits.” (Prasenjeet Paragraph 0014).
Tora in view of Chang in further view of Rosie in further view of Prasenjeet does not teach wherein generating the adjusted [frequency] threshold comprises, adjusting the [frequency] threshold based on a maturity level of the monitored computing system, and wherein the adjusted [frequency] threshold increases [exponentially] as the maturity level increases;
However, Yu does teach wherein generating the adjusted [frequency] threshold comprises, adjusting the [frequency] threshold based on a maturity level of the monitored computing system, and wherein the adjusted [frequency] threshold increases [exponentially] as the maturity level increases; (Yu Paragraph 0084; “The WLC threshold is increased over time, such as each time that a WLC swap occurs. The WLC threshold is initially much smaller than the BBN threshold, but as the system ages, the WLC threshold becomes larger.” Examiner notes that the threshold is adjusted based on a maturity level of the monitored computing system (as the system ages), and wherein the adjusted threshold increases as the maturity level increases (as the system ages, the WLC threshold becomes larger; as seen in Fig 8))
PNG
media_image4.png
240
496
media_image4.png
Greyscale
It would have obvious to one of ordinary skill in the art before the effective filing date of the present application to combine Tora, Chang, Rosie, Prasenjeet, and Yu. Tora teaches an anomaly detection apparatus that uses dictionary based classifier to classify the text logs. Chang teaches the benefits of using a plurality of sub-classifiers in a hybrid classifier to classify an object in an image. Rosie teaches bootstrapping for text learning tasks. Prasenjeet teaches anomaly detection and filtering based on system logs. Yu teaches increasing threshold as system ages. One of ordinary skill would have motivation to combine Tora, Chang, Rosie, Prasenjeet, and Yu to improve the fault tolerance of a system “The overall system fault tolerance is significantly improved.” (Yu Paragraph 0130).
Tora in view of Chang in further view of Rosie in further view of Prasenjeet in further view of Yu does not teach threshold increases exponentially
However, Day does teach threshold increases exponentially (Day Claim 12; “wherein the recurrence threshold is increased according to a binary exponential backoff algorithm;” Examiner notes that threshold increases exponentially (threshold is increased according to a binary exponential backoff algorithm))
It would have obvious to one of ordinary skill in the art before the effective filing date of the present application to combine Tora, Chang, Rosie, Prasenjeet, Yu, and Day. Tora teaches an anomaly detection apparatus that uses dictionary based classifier to classify the text logs. Chang teaches the benefits of using a plurality of sub-classifiers in a hybrid classifier to classify an object in an image. Rosie teaches bootstrapping for text learning tasks. Prasenjeet teaches anomaly detection and filtering based on system logs. Yu teaches increasing threshold as system ages. Day teaches increasing threshold based on a binary exponential backoff. One of ordinary skill would have motivation to combine Tora, Chang, Rosie, Prasenjeet, Yu, and Day to adjust the threshold to a match it to a level consistent with normal usage, and mitigate harmful effects “Such restricting, or throttling, does not absolutely prevent the user from connecting, but reduces it to a level consistent with normal usage, thus mitigating any harmful effects due to rapid connection attempts.” (Day Column 3 Line 47).
Tora in view of Chang in further view of Rosie in further view of Prasenjeet in further view of Yu in further view of Day does not teach identify a cause for the subsequent anomalous log line by identifying an additional anomalous log line associated with a different computing environment that is correlated to the subsequent anomalous log line;
However, XPLG does teach identify a cause for the subsequent anomalous log line by identifying an anomalous log line associated with another environment that is correlated to the subsequent anomalous log line; (XPLG Section "Tying the Threads Together" Paragraph 1; "It’s able to track actions throughout your system and trace the logs they generate. That’s the “correlate” part of log correlation. Under the hood, log correlation is a terrific bit of engineering. Application programmers build pattern-matching software which is able to direct the software to determine which parts of disparate logs represent the same action." XPLG Section "Working Automatically With Different Systems" Paragraph 1; "You’re able to quickly and smoothly determine how a bug traced through your system, and root out the cause in minutes. What’s more, slight configuration differences in systems can cause big problems in log collection." Examiner notes that identifying a cause for the subsequent anomalous log line by identifying an anomalous log line (track actions/logs to root cause) associated with a different computing environment (older version of system) that is correlated to the subsequent anomalous log line (track actions throughout your system and trace the logs they generate))
It would have obvious to one of ordinary skill in the art before the effective filing date of the present application to combine Tora, Chang, Rosie, Prasenjeet, Yu, Day, and XPLG. Tora teaches an anomaly detection apparatus that uses dictionary based classifier to classify the text logs. Chang teaches the benefits of using a plurality of sub-classifiers in a hybrid classifier to classify an object in an image. Rosie teaches bootstrapping for text learning tasks. Prasenjeet teaches anomaly detection and filtering based on system logs. Yu teaches increasing threshold as system ages. Day teaches increasing threshold based on a binary exponential backoff. XPLG teaches log correlation. One of ordinary skill would have motivation to combine Tora, Chang, Rosie, Prasenjeet, Yu, Day, and XPLG to utilize log correlation to simplify the visualization of data flows and reduce complexity “Log correlation is a tool to reduce the weight of that complexity. It provides real ways to simplify how you visualize data flowing through your systems. When implemented correctly, it even helps your team take action proactively.” (XPLG Section “Log Correlation Lets You Focus on What’s Important” Paragraph 1).
Regarding claim 16, Tora teaches The computer system of claim 15, wherein identifying the subsequent log line as the subsequent anomalous log line utilizing the trained log anomaly model, comprises causing the one or more computer processors to: templatize the subsequent log line to generate a templatized subsequent log line; (Tora Paragraph 0035; “The template is composed of a template ID and a word sequence.” Tora Paragraph 0036; "the classification unit 15a compares each word sequence of a group of templates in the dictionary information stored in the storage unit 14 with each of the classified words, and when there is a template for which the word sequence matches all the words in a portion classified as non-parameter in the message, the classification unit 15a assigns the ID of the template to the message." Tora Paragraph 0065; “When messages included in the text log output from the system are acquired... Thus, the anomaly detection apparatus 10 can detect an unknown anomaly.” Examiner notes that assigning the ID of the template to the message is templatizing; Each word sequence is each classified erroneous log line and non-erroneous log line in the plurality of unlabeled log lines; Paragraph 0065 explains the flow of when a message/subsequent log line is acquired);
and match the templatized subsequent log line into one of the erroneous log template cluster or one of the non-erroneous log template cluster. (Tora Paragraph 0036; "and when there is a template for which the word sequence matches all the words in a portion classified as non-parameter in the message, the classification unit 15a assigns the ID of the template to the message." Examiner notes templatized subsequent log line is matched into appropriate template clusters based on the template IDs; ID is associated with erroneous or non-erroneous log template cluster);
Regarding claim 17, Tora teaches The computer program product of claim 16, wherein the stored program instructions, when executed by the one or more computer processors, further cause the one or more computer processors to: responsive to the templatized subsequent log line failing to match into any of the erroneous log template clusters, classify the subsequent log line as the subsequent anomalous log line; (Tora Paragraph 0037; "In addition, when classifying a message, in the case where a template having a word sequence that matches all the words in the portion classified as non-parameter is not present in the group of templates in the dictionary information stored in the storage unit 14" Tora Paragraph 0049; "if the system is operated stably, unknown logs appear for a certain period of time in an initial stage, but the frequency of appearance of the unknown logs decreases. Then, as illustrated in FIG. 8, when an unknown event such as a failure or maintenance occurs in the system, a large amount of unknown logs appear in a predetermined period of time." Examiner notes that an unclassified/unknown event is classifying the subsequent log line as anomalous);
Create a new erroneous log template cluster with the templatized subsequent log line; (Tora Paragraph 0037; "the classification unit 15a may create a new template having the word sequence based on the message and generate a new template with a new ID.");
Set a frequency of the new erroneous log template cluster to one; (Tora Paragraph 0050; "the detection unit 15b counts the number of new IDs assigned per day, and monitors whether the number of new IDs assigned per day exceeds the threshold 250." Examiner notes that to count the number of new IDs/created erroneous log template cluster, the first occurrence will be tracked/set.);
and classify an occurrence of similar log lines as anomalous until the [adjusted] frequency threshold is reached (Tora Paragraph 0050; "Then, the detection unit 15b detects an anomaly when the number of new IDs assigned per day exceeds the threshold “250”. Note that the setting of the threshold can be freely changed." Examiner notes the occurrence of similar log lines are classified as an anomaly until a threshold is met/reached);
Regarding claim 18, Tora teaches The computer program product of claim 16, wherein stored program instructions, when executed by the one or more computer processors, further cause the one or more computer processors to: responsive to the templatized subsequent log line failing to match into any of the one or more non-erroneous log template clusters, classify the subsequent log line as a non-anomalous log line; (Tora Paragraph 0037; "In addition, when classifying a message, in the case where a template having a word sequence that matches all the words in the portion classified as non-parameter is not present in the group of templates in the dictionary information stored in the storage unit 14" Tora Paragraph 0049; "if the system is operated stably, unknown logs appear for a certain period of time in an initial stage, but the frequency of appearance of the unknown logs decreases. Then, as illustrated in FIG. 8, when an unknown event such as a failure or maintenance occurs in the system, a large amount of unknown logs appear in a predetermined period of time." Examiner notes that an unclassified/unknown event is classifying the subsequent log line as non-anomalous;);
Create a new non-erroneous log template cluster with the templatized subsequent log line; (Tora Paragraph 0037; "the classification unit 15a may create a new template having the word sequence based on the message and generate a new template with a new ID.");
Set a frequency of the new non-erroneous log template cluster to one; (Tora Paragraph 0050; "the detection unit 15b counts the number of new IDs assigned per day, and monitors whether the number of new IDs assigned per day exceeds the threshold 250." Examiner notes that to count the number of new IDs/created erroneous log template cluster, the first occurrence will be tracked/set.);
and classify an occurrence of similar log lines as non-anomalous until the [adjusted] frequency threshold and a timestamp threshold are reached (Tora Paragraph 0050; "Then, the detection unit 15b detects an anomaly when the number of new IDs assigned per day exceeds the threshold “250”. Note that the setting of the threshold can be freely changed." Examiner notes the occurrence of similar log lines are not classified as an anomaly until a threshold is met/reached)
Regarding claim 19, Tora teaches The computer system of claim 15, wherein stored program instructions, when executed by the one or more computer processors, further cause the one or more computer processors to: implement a remedy to the subsequent anomalous log line. (Tora Paragraph 0053; "an unknown anomaly can be found early by monitoring the number of new IDs assigned per unit time, and it is possible to perform troubleshooting before the user report." Examiner notes that troubleshooting is implementing a remedy)
Regarding claim 20, Tora teaches The computer system of claim 15, wherein the dictionary based classifier is bootstrapped utilizing a plurality of invariants and parameters identified in the software documentation and in product documentation associated with the monitored computing system.
However, Rosie does teach The computer-implemented method of claim 1, wherein the dictionary based classifier is bootstrapped utilizing a plurality of invariants and parameters identified in the software documentation and in product documentation associated with the monitored computing system. (Rosie Table 2 shows a bootstrapping algorithm to output a naïve Bayes classifier; Rosie Section 3 Paragraph 3; “Using bootstrapping techniques described in section 2, we have developed an algorithm that can learn dictionaries for information extraction without any special training resources.” Rosie Section 4.3 Paragraph 1; “As a test domain, we use computer science research papers.” Examiner notes that the bootstrapping uses computer science research papers which include a plurality of invariants and parameters (information in) software documentation and in product documentation associated with the monitored computing system as shown in Figure 5; bootstrapping techniques learn dictionaries making the classifier dictionary based)
It would have obvious to one of ordinary skill in the art before the effective filing date of the present application to combine Tora, Chang, and Rosie. Tora teaches an anomaly detection apparatus that uses dictionary based classifier to classify the text logs. Chang teaches the benefits of using a plurality of sub-classifiers in a hybrid classifier to classify an object in an image. Rosie teaches bootstrapping for text learning tasks. One of ordinary skill would have motivation to combine Tora, Chang, and Rosie to utilize bootstrapping techniques to gain semantic lexicon and extraction patterns without special training resources “Our bootstrapping approach has two advantages over previous techniques for learning information extraction dictionaries: both a semantic lexicon and a dictionary of extraction patterns are acquired simultaneously, and no special training resources are needed” (Rosie 1 Paragraph prior to Section 4).
Claim(s) 7 and 14 are rejected under 35 U.S.C. 103 as being unpatentable over TORA; Shotaro et al; US 20220123988 A1 (hereinafter “Tora”) in view of CHANG PENG et al; WO 2006026688 A2 (hereinafter “Chang”) in further view of Rosie et al; “Bootstrapping for Text Learning Tasks” (hereinafter “Rosie”) in further view of Prasenjeet et al; US 20220103418 A1 (hereinafter “Prasenjeet”) in further view of Frank Yu et al; US 20120278543 A1 (hereinafter “Yu”) in further view of Mark Stuart Day; US 7814542 B1 (hereinafter “Day”) in further view of XPLG.com; “What Is Log Correlation? Making Sense of Disparate Logs” (hereinafter “XPLG”) in further view of Xue; Yongbing et al; US 20220327016 A1 (hereinafter “Xue”)
Regarding claim 7, Tora does not teach The computer-implemented method of claim 1, wherein the trained log anomaly model is a neural network. However, Xue does teach The computer-implemented method of claim 1, wherein the trained log anomaly model is a neural network. (Xue Paragraph 0029; "The “model” may sometimes be referred to as a “neural network")
It would have obvious to one of ordinary skill in the art before the effective filing date of the present application to combine Tora, Chang, Rosie, Prasenjeet, Yu, Day, XPLG, and Xue. Tora teaches an anomaly detection apparatus that uses dictionary based classifier to classify the text logs. Chang teaches the benefits of using a plurality of sub-classifiers in a hybrid classifier to classify an object in an image. Rosie teaches bootstrapping for text learning tasks. Prasenjeet teaches anomaly detection and filtering based on system logs. Yu teaches increasing threshold as system ages. Day teaches increasing threshold based on a binary exponential backoff. XPLG teaches log correlation. Xue teaches whether a log entry is usable based on a maturity score of the log file. One of ordinary skill would have motivation to combine Tora, Chang, Rosie, Prasenjeet, Yu, Day, XPLG, and Xue to utilize log maturity in identifying if a log line is anomalous because it shows a normality/standardization of a log “The log maturity may indicate the degree of standardization of a log, and a standardized log is the basis for subsequent processing.” (Xue Paragraph 0033).
Regarding claim 14, Tora does not teach The computer program product of claim 8, wherein the trained log anomaly model is a neural network. However, Xue does teach The computer program product of claim 8, wherein the trained log anomaly model is a neural network. (Xue Paragraph 0029; "The “model” may sometimes be referred to as a “neural network")
It would have obvious to one of ordinary skill in the art before the effective filing date of the present application to combine Tora, Chang, Rosie, Prasenjeet, Yu, Day, XPLG, and Xue. Tora teaches an anomaly detection apparatus that uses dictionary based classifier to classify the text logs. Chang teaches the benefits of using a plurality of sub-classifiers in a hybrid classifier to classify an object in an image. Rosie teaches bootstrapping for text learning tasks. Prasenjeet teaches anomaly detection and filtering based on system logs. Yu teaches increasing threshold as system ages. Day teaches increasing threshold based on a binary exponential backoff. XPLG teaches log correlation. Xue teaches whether a log entry is usable based on a maturity score of the log file. One of ordinary skill would have motivation to combine Tora, Chang, Rosie, Prasenjeet, Yu, Day, XPLG, and Xue to utilize log maturity in identifying if a log line is anomalous because it shows a normality/standardization of a log “The log maturity may indicate the degree of standardization of a log, and a standardized log is the basis for subsequent processing.” (Xue Paragraph 0033).
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to DANIEL DUC TRAN whose telephone number is (571)272-6870. The examiner can normally be reached Mon-Fri 8:00-5:00 EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Viker Lamardo can be reached at (571) 270-5871. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/D.D.T./Examiner, Art Unit 2147
/VIKER A LAMARDO/Supervisory Patent Examiner, Art Unit 2147
Prosecution Insights